General

  • Target

    f1c352ea96ece88a30907d29859e67ff8bf5705c273fe5e9ffffeb650d302082

  • Size

    231KB

  • Sample

    231121-bcztdsbb94

  • MD5

    d4a2f8b524dcd050aa2438ce42d0a835

  • SHA1

    5008a5397c86a4573878e6b6dd541abd952a7b64

  • SHA256

    f1c352ea96ece88a30907d29859e67ff8bf5705c273fe5e9ffffeb650d302082

  • SHA512

    34b023f3b1ad9a889327dc69c2335dc7c9a02ee2c1c11a9a10fe7cf37ccf763c0a4efac9e1835bde9e40a259e7c1f811ec6b0d2a3fde186e8c206e6d0fd7ef13

  • SSDEEP

    6144:8b75Ylmz6n+EspqUTb/sCR8YQY7d1QW8V:m8+EsQ4/s0NhL

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      f1c352ea96ece88a30907d29859e67ff8bf5705c273fe5e9ffffeb650d302082

    • Size

      231KB

    • MD5

      d4a2f8b524dcd050aa2438ce42d0a835

    • SHA1

      5008a5397c86a4573878e6b6dd541abd952a7b64

    • SHA256

      f1c352ea96ece88a30907d29859e67ff8bf5705c273fe5e9ffffeb650d302082

    • SHA512

      34b023f3b1ad9a889327dc69c2335dc7c9a02ee2c1c11a9a10fe7cf37ccf763c0a4efac9e1835bde9e40a259e7c1f811ec6b0d2a3fde186e8c206e6d0fd7ef13

    • SSDEEP

      6144:8b75Ylmz6n+EspqUTb/sCR8YQY7d1QW8V:m8+EsQ4/s0NhL

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks