General
-
Target
b9ab9bd0a0f8ddfac1f9613ea21bc29ab79956c6f4eef20386739061a54e1c1d
-
Size
1.2MB
-
Sample
231210-d1dbeaddc9
-
MD5
d3b168a20b80013c50cd8eb52dd026fd
-
SHA1
5eb20960b003b4e1464594be3a2c19bd9cae5887
-
SHA256
b9ab9bd0a0f8ddfac1f9613ea21bc29ab79956c6f4eef20386739061a54e1c1d
-
SHA512
2a134d5b14f8ffd045aae8ca9d9c8aec9e1d35cf4154b19a9a0acd1fb012ccceaee0e2902ab051e4675f84087507a041f0c66a434141091816ba3d607e05a2a8
-
SSDEEP
24576:qyJVuytd4GKCtMWN1zmz618koyXySWv9iVlGdR6x+Y++SPZ:x3pPCWN1Sz613erv9iVIdR6x+zt
Static task
static1
Behavioral task
behavioral1
Sample
b9ab9bd0a0f8ddfac1f9613ea21bc29ab79956c6f4eef20386739061a54e1c1d.exe
Resource
win10v2004-20231201-en
Malware Config
Extracted
risepro
193.233.132.51
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Targets
-
-
Target
b9ab9bd0a0f8ddfac1f9613ea21bc29ab79956c6f4eef20386739061a54e1c1d
-
Size
1.2MB
-
MD5
d3b168a20b80013c50cd8eb52dd026fd
-
SHA1
5eb20960b003b4e1464594be3a2c19bd9cae5887
-
SHA256
b9ab9bd0a0f8ddfac1f9613ea21bc29ab79956c6f4eef20386739061a54e1c1d
-
SHA512
2a134d5b14f8ffd045aae8ca9d9c8aec9e1d35cf4154b19a9a0acd1fb012ccceaee0e2902ab051e4675f84087507a041f0c66a434141091816ba3d607e05a2a8
-
SSDEEP
24576:qyJVuytd4GKCtMWN1zmz618koyXySWv9iVlGdR6x+Y++SPZ:x3pPCWN1Sz613erv9iVIdR6x+zt
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1