General

  • Target

    bbd51015a08c43511cac74f613bff1060a50c719bc882afe150e4d3c58033aaa

  • Size

    226KB

  • Sample

    231016-fj3ababf6z

  • MD5

    c054b59d8acd94091def95ac0eb1b21d

  • SHA1

    e68d53a92b4da038658db809ace8a336f711b8db

  • SHA256

    bbd51015a08c43511cac74f613bff1060a50c719bc882afe150e4d3c58033aaa

  • SHA512

    7d4af6a9bf8e4aa2c01f5bf4774c533de8ad2f349e6e07306027f84b7a62dcb0d9daff5c480db5c071401cb0e7c4e1a3ae6213585dc83cc20b845031ea61405e

  • SSDEEP

    3072:pEgEEThQUWX4kOqi2L+gKtSKvqwQZ5UuRxr:6gEE9QUhk3ygKtSCqwh

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      bbd51015a08c43511cac74f613bff1060a50c719bc882afe150e4d3c58033aaa

    • Size

      226KB

    • MD5

      c054b59d8acd94091def95ac0eb1b21d

    • SHA1

      e68d53a92b4da038658db809ace8a336f711b8db

    • SHA256

      bbd51015a08c43511cac74f613bff1060a50c719bc882afe150e4d3c58033aaa

    • SHA512

      7d4af6a9bf8e4aa2c01f5bf4774c533de8ad2f349e6e07306027f84b7a62dcb0d9daff5c480db5c071401cb0e7c4e1a3ae6213585dc83cc20b845031ea61405e

    • SSDEEP

      3072:pEgEEThQUWX4kOqi2L+gKtSKvqwQZ5UuRxr:6gEE9QUhk3ygKtSCqwh

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks