General

  • Target

    65fb843b6f2fa0f8520a070b0dca0b408caeba2f71d324ac4750f1ca9445f678

  • Size

    265KB

  • Sample

    231012-nknsbaff4z

  • MD5

    88e20492a418f8d85da4bc11fd103972

  • SHA1

    3759a8e23bab9b1f0432b1d021c47c265e305148

  • SHA256

    65fb843b6f2fa0f8520a070b0dca0b408caeba2f71d324ac4750f1ca9445f678

  • SHA512

    f50c9343bb9e006596c0186b1a372395e668bd7e2929fab19eef090737af3df8848b8edb556eac1da8e24c1b7f19fc436729e8f99d938f677a90c78e108e44f9

  • SSDEEP

    3072:o7X0rrWdPgrVGhbtZRJv7QV17cYRmEwYvuUa4z:GqrtrEhbDnc4sCYvuUa

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      65fb843b6f2fa0f8520a070b0dca0b408caeba2f71d324ac4750f1ca9445f678

    • Size

      265KB

    • MD5

      88e20492a418f8d85da4bc11fd103972

    • SHA1

      3759a8e23bab9b1f0432b1d021c47c265e305148

    • SHA256

      65fb843b6f2fa0f8520a070b0dca0b408caeba2f71d324ac4750f1ca9445f678

    • SHA512

      f50c9343bb9e006596c0186b1a372395e668bd7e2929fab19eef090737af3df8848b8edb556eac1da8e24c1b7f19fc436729e8f99d938f677a90c78e108e44f9

    • SSDEEP

      3072:o7X0rrWdPgrVGhbtZRJv7QV17cYRmEwYvuUa4z:GqrtrEhbDnc4sCYvuUa

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks