General

  • Target

    a96d988eb1203564d56cef3f0defa3b31c67d3db3ef3429261b8a65f51aa0e46

  • Size

    201KB

  • Sample

    231114-ph5tgsba46

  • MD5

    fa67618a2ed91badc176c1788cd4307f

  • SHA1

    b380018d6cb816c7058f3f0baa08eace3d935ef7

  • SHA256

    a96d988eb1203564d56cef3f0defa3b31c67d3db3ef3429261b8a65f51aa0e46

  • SHA512

    ffe598e32688fb8627abf8169a28761943e00c25ced8667e6bf05fc6890249a4c544264c053eee00e326f10ccd64343a67eae901dde155f7fb9a7d252859f4a3

  • SSDEEP

    3072:ZqnVy+d0w22DcmfDrPz0eVCsi6bvVOQrE1UKpDkkw0RWMY71nA:h+2b2ccDHJVCxcRE1UK+0RWMO

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      a96d988eb1203564d56cef3f0defa3b31c67d3db3ef3429261b8a65f51aa0e46

    • Size

      201KB

    • MD5

      fa67618a2ed91badc176c1788cd4307f

    • SHA1

      b380018d6cb816c7058f3f0baa08eace3d935ef7

    • SHA256

      a96d988eb1203564d56cef3f0defa3b31c67d3db3ef3429261b8a65f51aa0e46

    • SHA512

      ffe598e32688fb8627abf8169a28761943e00c25ced8667e6bf05fc6890249a4c544264c053eee00e326f10ccd64343a67eae901dde155f7fb9a7d252859f4a3

    • SSDEEP

      3072:ZqnVy+d0w22DcmfDrPz0eVCsi6bvVOQrE1UKpDkkw0RWMY71nA:h+2b2ccDHJVCxcRE1UK+0RWMO

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks