General

  • Target

    74d49caa0e8054010ca59c0684391a25.bin

  • Size

    128KB

  • Sample

    231101-b3tp3aag46

  • MD5

    748911d4b5544753454a5123774b6867

  • SHA1

    ac365290dc76397aecb70efc2fcd9588fed0116d

  • SHA256

    9f1da5875fe87221d00c50bd14ee8c214e10cd78c127d59ec4db43bcca77aba2

  • SHA512

    d7d9f488c5e1ab274fcbe228c625d030a5321f1589b7aff342db6f3ed2299cff397b1b8a7d5411f445c6805b020ced811e7a5e81b2b73e1027c3e1fa1454a1a6

  • SSDEEP

    3072:GRxVWkZyfZAPcIor4IZj1G2qZgRgXawd3kmN9GysJS:GnVHZyRAPcIoE+j1G1mRghd1NtKS

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      728a55ab40a62e82b72a191c56d10c804d4b2b2bd8217832c70d3696576a84e1.exe

    • Size

      260KB

    • MD5

      74d49caa0e8054010ca59c0684391a25

    • SHA1

      1f9122ba5dd88b26017d125fb5384237dea985f5

    • SHA256

      728a55ab40a62e82b72a191c56d10c804d4b2b2bd8217832c70d3696576a84e1

    • SHA512

      e0d4d959eeb373242461e39c86f4c63611bc6c1b24a296c9982bf77831be1ff5c5953c606c46f023d5edb8fedf1aed2ef6a0942cb0ae0da54a69733afe95e799

    • SSDEEP

      3072:SgBNQMoGW76aFvLC+EEV9Xo5EmfdTK+BKzsHI6MX0nfmKVqHv:vgGW2aFvLCWIDfdP0sHI6MX0nfd+v

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks