General

  • Target

    416392dae28120d0cb8868aed33e5765

  • Size

    315KB

  • Sample

    231222-bhs8sschg8

  • MD5

    416392dae28120d0cb8868aed33e5765

  • SHA1

    bb4661be43536658ca109757cebe18ca13f17b98

  • SHA256

    d902fa8f486a828b78882393eda791dd9798327cc9fb2db790a8b566a1e45ace

  • SHA512

    4701eefcaf54fd2abcf121374885498678d83bb527d914fdbdb71582b15f2828a6135c266324e308a4f3984ccc95d6c1ee2b18845489825e63f011348eb0c4c9

  • SSDEEP

    3072:qigBishTEkqI4MdEzOuxkNyuDdOFH+o+7u8zvuqygWIySKgy7q1QvSbOuiXCsY/s:qi0ishTE6b7uxkooOFHHmWUX/bq7GOU

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Targets

    • Target

      416392dae28120d0cb8868aed33e5765

    • Size

      315KB

    • MD5

      416392dae28120d0cb8868aed33e5765

    • SHA1

      bb4661be43536658ca109757cebe18ca13f17b98

    • SHA256

      d902fa8f486a828b78882393eda791dd9798327cc9fb2db790a8b566a1e45ace

    • SHA512

      4701eefcaf54fd2abcf121374885498678d83bb527d914fdbdb71582b15f2828a6135c266324e308a4f3984ccc95d6c1ee2b18845489825e63f011348eb0c4c9

    • SSDEEP

      3072:qigBishTEkqI4MdEzOuxkNyuDdOFH+o+7u8zvuqygWIySKgy7q1QvSbOuiXCsY/s:qi0ishTE6b7uxkooOFHHmWUX/bq7GOU

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

    • Modifies firewall policy service

    • Modifies security service

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Disables taskbar notifications via registry modification

    • Disables use of System Restore points

    • Sets file execution options in registry

    • Sets service image path in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks