Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    72787c0133ebe280a7d16f6db8000bcd

  • Size

    326KB

  • Sample

    231226-qqvh6ahgen

  • MD5

    72787c0133ebe280a7d16f6db8000bcd

  • SHA1

    b287f8d7f22ded27444ae999e65a599cca8cc60a

  • SHA256

    01e062f17f17f54100c3d6849477017acdd7bd57f751a7eb18484c77474d5a6a

  • SHA512

    8e2fd5d50d0f4579a5b7721d5c1fdc6bef1582822a723f293cf0b982eee588bf9d933499c5c16941474a4e3928c42d2305984652aa9542ac31ebcea4dcd9c596

  • SSDEEP

    6144:FXURnqgV/GvULWy9BtdNVJjq3MGMXmSUexV:FonTTWy9BFVJLmUx

Malware Config

Extracted

Family

smokeloader

Botnet

0002

Extracted

Family

smokeloader

Version

2020

C2

https://cinems.club/search.php

https://clothes.surf/search.php

rc4.i32
rc4.i32

Targets

    • Target

      72787c0133ebe280a7d16f6db8000bcd

    • Size

      326KB

    • MD5

      72787c0133ebe280a7d16f6db8000bcd

    • SHA1

      b287f8d7f22ded27444ae999e65a599cca8cc60a

    • SHA256

      01e062f17f17f54100c3d6849477017acdd7bd57f751a7eb18484c77474d5a6a

    • SHA512

      8e2fd5d50d0f4579a5b7721d5c1fdc6bef1582822a723f293cf0b982eee588bf9d933499c5c16941474a4e3928c42d2305984652aa9542ac31ebcea4dcd9c596

    • SSDEEP

      6144:FXURnqgV/GvULWy9BtdNVJjq3MGMXmSUexV:FonTTWy9BFVJLmUx

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks