General
-
Target
2f704a4d86623681b7cb714ca52ebe9f848e99aeff81b067f15c8e1021c60773
-
Size
1.2MB
-
Sample
231210-g5bj6acden
-
MD5
173f8c353d6679b03c4baca0bf7520c7
-
SHA1
70ef894f67e1d773b9d4cd5f522851a0f3da641b
-
SHA256
2f704a4d86623681b7cb714ca52ebe9f848e99aeff81b067f15c8e1021c60773
-
SHA512
36a683871c84d3971223f94d55b40cdaeceea95e1871dc4cf9b9e3dd119ba228398bde654d7c7d8aea42c11da6507b7b751ab75614fcd86f0d157da6fb2bb5e8
-
SSDEEP
24576:xykcG5d4yh7fWS18zNKhsPyXh0maZ6CBBRgDUlf9EBGOZ:kkcG5PVWS18zNKW/Z62ByDAE
Static task
static1
Behavioral task
behavioral1
Sample
2f704a4d86623681b7cb714ca52ebe9f848e99aeff81b067f15c8e1021c60773.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
risepro
193.233.132.51
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Targets
-
-
Target
2f704a4d86623681b7cb714ca52ebe9f848e99aeff81b067f15c8e1021c60773
-
Size
1.2MB
-
MD5
173f8c353d6679b03c4baca0bf7520c7
-
SHA1
70ef894f67e1d773b9d4cd5f522851a0f3da641b
-
SHA256
2f704a4d86623681b7cb714ca52ebe9f848e99aeff81b067f15c8e1021c60773
-
SHA512
36a683871c84d3971223f94d55b40cdaeceea95e1871dc4cf9b9e3dd119ba228398bde654d7c7d8aea42c11da6507b7b751ab75614fcd86f0d157da6fb2bb5e8
-
SSDEEP
24576:xykcG5d4yh7fWS18zNKhsPyXh0maZ6CBBRgDUlf9EBGOZ:kkcG5PVWS18zNKW/Z62ByDAE
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1