General

  • Target

    ce4d4d90930a76c70509f754b056ac01f31c18057174438033a0730139095f75

  • Size

    271KB

  • Sample

    231117-rtlwvsaa69

  • MD5

    012cea5b54f5cbdc516e264ffc132a22

  • SHA1

    6673a76737901f7c8ae01fb0d46dc81ad4a8cb57

  • SHA256

    ce4d4d90930a76c70509f754b056ac01f31c18057174438033a0730139095f75

  • SHA512

    939de6c679ee1fa923bd4fbd2f25266d96dfdeb17360f70364754c850dd66d730f17353318ae7ff28b3fa550cc4cd79a269a5d8232d9315791f1fe86f660d122

  • SSDEEP

    3072:+zK1Ijv9DbX1n27OOV0LaCl6UqjP2HnwJLv7F3bf7Zfk46RsVxz+da39iVR:8cav9FjjaCl6UseHOLzRf7BkQVx1M

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      ce4d4d90930a76c70509f754b056ac01f31c18057174438033a0730139095f75

    • Size

      271KB

    • MD5

      012cea5b54f5cbdc516e264ffc132a22

    • SHA1

      6673a76737901f7c8ae01fb0d46dc81ad4a8cb57

    • SHA256

      ce4d4d90930a76c70509f754b056ac01f31c18057174438033a0730139095f75

    • SHA512

      939de6c679ee1fa923bd4fbd2f25266d96dfdeb17360f70364754c850dd66d730f17353318ae7ff28b3fa550cc4cd79a269a5d8232d9315791f1fe86f660d122

    • SSDEEP

      3072:+zK1Ijv9DbX1n27OOV0LaCl6UqjP2HnwJLv7F3bf7Zfk46RsVxz+da39iVR:8cav9FjjaCl6UseHOLzRf7BkQVx1M

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks