General

  • Target

    3ee3c086601e3e7093789bd576bbfc0da9cc61633f576ebec7729595a25ec60c

  • Size

    218KB

  • Sample

    231111-pb8a2afg67

  • MD5

    c2e7a31096c570c4b7bf0e505e1b7dfa

  • SHA1

    f2cdafb38219519b161baf744a5910dca3dfb17a

  • SHA256

    3ee3c086601e3e7093789bd576bbfc0da9cc61633f576ebec7729595a25ec60c

  • SHA512

    2dfc28edcf0d41a7b5c68388fa2140f8e52bb4cb6ef3170b3837b0ff8998bb2611199727a378162f05ba73cf6966df5dee2f353b8823115a1c11b65bc940be52

  • SSDEEP

    3072:9I7114HktgSKyCos5tg9wM66VYGiApfvNluLCRbojT:9GE+5bs5u9jpfrDo

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      3ee3c086601e3e7093789bd576bbfc0da9cc61633f576ebec7729595a25ec60c

    • Size

      218KB

    • MD5

      c2e7a31096c570c4b7bf0e505e1b7dfa

    • SHA1

      f2cdafb38219519b161baf744a5910dca3dfb17a

    • SHA256

      3ee3c086601e3e7093789bd576bbfc0da9cc61633f576ebec7729595a25ec60c

    • SHA512

      2dfc28edcf0d41a7b5c68388fa2140f8e52bb4cb6ef3170b3837b0ff8998bb2611199727a378162f05ba73cf6966df5dee2f353b8823115a1c11b65bc940be52

    • SSDEEP

      3072:9I7114HktgSKyCos5tg9wM66VYGiApfvNluLCRbojT:9GE+5bs5u9jpfrDo

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks