General

  • Target

    c3d46ec2a43121addb63f888898a6c4c

  • Size

    312KB

  • Sample

    231228-e8nb1schg5

  • MD5

    c3d46ec2a43121addb63f888898a6c4c

  • SHA1

    cef048818317c9fbc78aeb9a3616fa26b85adf9b

  • SHA256

    b84d0e2da061fe4351038a88a6baef71cd5743857eb5358d4396a3b5b3364a51

  • SHA512

    fbaabd0854807a15233097869f39c2b91c61739db07c97af604e354a2e5592fac26bda46726f17b3eeb453fdabb568a93ff0e2b566f36fc2fc8c603c09d99317

  • SSDEEP

    6144:J3vG7UDigdS5/Gs+dyJXCu+h9/MW0yJe9+2h905rnx78SaTsLuY:JOYD7dS9J+dMCuW/MI+v0dlXuY

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Targets

    • Target

      c3d46ec2a43121addb63f888898a6c4c

    • Size

      312KB

    • MD5

      c3d46ec2a43121addb63f888898a6c4c

    • SHA1

      cef048818317c9fbc78aeb9a3616fa26b85adf9b

    • SHA256

      b84d0e2da061fe4351038a88a6baef71cd5743857eb5358d4396a3b5b3364a51

    • SHA512

      fbaabd0854807a15233097869f39c2b91c61739db07c97af604e354a2e5592fac26bda46726f17b3eeb453fdabb568a93ff0e2b566f36fc2fc8c603c09d99317

    • SSDEEP

      6144:J3vG7UDigdS5/Gs+dyJXCu+h9/MW0yJe9+2h905rnx78SaTsLuY:JOYD7dS9J+dMCuW/MI+v0dlXuY

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks