General

  • Target

    toolspub2.exe

  • Size

    190KB

  • Sample

    231012-q3sv4ace8w

  • MD5

    a137245d8bc8109c4bc3df6e2b37d327

  • SHA1

    ed8973e65b2aacb60683787831de37e7c805fa6c

  • SHA256

    f342950ea78a3910911df852de530912090acea09b895e299d4ba0132ee146ee

  • SHA512

    5d83e91ac5862c62d5b90418a75feaedcffb01aa2a396d1cb71c11d9dfbfb0e415d38687ce0736b7159f874835ace02f27d11067b2ab6b81f58a948f10fabc00

  • SSDEEP

    3072:NmryVYLB2K+OZvhatgDcYYkTz1ICn55cD5WJA2Y:CLEKfZvlc4X13559X

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      toolspub2.exe

    • Size

      190KB

    • MD5

      a137245d8bc8109c4bc3df6e2b37d327

    • SHA1

      ed8973e65b2aacb60683787831de37e7c805fa6c

    • SHA256

      f342950ea78a3910911df852de530912090acea09b895e299d4ba0132ee146ee

    • SHA512

      5d83e91ac5862c62d5b90418a75feaedcffb01aa2a396d1cb71c11d9dfbfb0e415d38687ce0736b7159f874835ace02f27d11067b2ab6b81f58a948f10fabc00

    • SSDEEP

      3072:NmryVYLB2K+OZvhatgDcYYkTz1ICn55cD5WJA2Y:CLEKfZvlc4X13559X

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks