General

  • Target

    d30ce0a731234aa07c990f3b142720a5071e4a0ad684aac53381ab3b9d7ca6b0

  • Size

    261KB

  • Sample

    231123-az39naga31

  • MD5

    3ccab5ab8cb6559c5bcb6cc89f1e9b3c

  • SHA1

    efdbc6928012d04c005221c516f9ae8cdd30b301

  • SHA256

    d30ce0a731234aa07c990f3b142720a5071e4a0ad684aac53381ab3b9d7ca6b0

  • SHA512

    e69bf005a963a5c7cda03891f85b0adaba561b606fb2d850114461defeb7fc3c9a233ac0f7332e1d0b3de86ced0df0df1d2db4ef03badd1b5d66553ec039e1f6

  • SSDEEP

    3072:vOZgDJkyMGZ+IWS6tQT9ccrFTy9jsBbY9Wcf5t6D9ZPEIAT:hzMY/nqQBJJTy1sHc6jPy

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      d30ce0a731234aa07c990f3b142720a5071e4a0ad684aac53381ab3b9d7ca6b0

    • Size

      261KB

    • MD5

      3ccab5ab8cb6559c5bcb6cc89f1e9b3c

    • SHA1

      efdbc6928012d04c005221c516f9ae8cdd30b301

    • SHA256

      d30ce0a731234aa07c990f3b142720a5071e4a0ad684aac53381ab3b9d7ca6b0

    • SHA512

      e69bf005a963a5c7cda03891f85b0adaba561b606fb2d850114461defeb7fc3c9a233ac0f7332e1d0b3de86ced0df0df1d2db4ef03badd1b5d66553ec039e1f6

    • SSDEEP

      3072:vOZgDJkyMGZ+IWS6tQT9ccrFTy9jsBbY9Wcf5t6D9ZPEIAT:hzMY/nqQBJJTy1sHc6jPy

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks