General
-
Target
b73882bc01383cb085aebf15b35f46822577284997b1bf7599c56a17bb9fa87a
-
Size
2.6MB
-
Sample
231207-v8emwaeb96
-
MD5
3e2f458ee8b29e7301804a40020577ac
-
SHA1
d30e7c3f62ab372601e43c0fe4016ed9e7986195
-
SHA256
b73882bc01383cb085aebf15b35f46822577284997b1bf7599c56a17bb9fa87a
-
SHA512
9325e521a1f6d005847cfe2dbe989f6685f1d0fbc269ce20935f37e9ba478da0d76db4ad8293eee1d5aa28f9ea02217dc04051795e0a379df66e53ab490bca97
-
SSDEEP
49152:eaF3iZXAhej7GHJzaNxfv8S4zqm1efzAio+rqCKVqNtTFTeO2wfqi:RuAQv+mv8wzpo++0TFTqwff
Static task
static1
Behavioral task
behavioral1
Sample
b73882bc01383cb085aebf15b35f46822577284997b1bf7599c56a17bb9fa87a.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
risepro
193.233.132.51
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Targets
-
-
Target
b73882bc01383cb085aebf15b35f46822577284997b1bf7599c56a17bb9fa87a
-
Size
2.6MB
-
MD5
3e2f458ee8b29e7301804a40020577ac
-
SHA1
d30e7c3f62ab372601e43c0fe4016ed9e7986195
-
SHA256
b73882bc01383cb085aebf15b35f46822577284997b1bf7599c56a17bb9fa87a
-
SHA512
9325e521a1f6d005847cfe2dbe989f6685f1d0fbc269ce20935f37e9ba478da0d76db4ad8293eee1d5aa28f9ea02217dc04051795e0a379df66e53ab490bca97
-
SSDEEP
49152:eaF3iZXAhej7GHJzaNxfv8S4zqm1efzAio+rqCKVqNtTFTeO2wfqi:RuAQv+mv8wzpo++0TFTqwff
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1