General

  • Target

    f35dbaff6f328daa836dcab2a80cf3efae4dd574788e153a7ecd27f52da9dee1

  • Size

    307KB

  • Sample

    240204-el1ntshcc9

  • MD5

    5eacfa3bd68b1116875173c7a9a02bb5

  • SHA1

    442959e7a3e4ee866a0185833d27deae8e2d5aad

  • SHA256

    f35dbaff6f328daa836dcab2a80cf3efae4dd574788e153a7ecd27f52da9dee1

  • SHA512

    1cb935156a4506b89d5a9b27176f29634e2de9b2e5ab82a2c6050fc4bb85b50838f4d14e78e3165fd1d48006f2e3d9c48c40da79743f4982de179f35e7d3a804

  • SSDEEP

    3072:oT2lsEO4HsAUnK4q7crAa2JEnT1L6Ft5JgRMu63jXdo:59O4Ha1Gckq5mFpg6jX

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      f35dbaff6f328daa836dcab2a80cf3efae4dd574788e153a7ecd27f52da9dee1

    • Size

      307KB

    • MD5

      5eacfa3bd68b1116875173c7a9a02bb5

    • SHA1

      442959e7a3e4ee866a0185833d27deae8e2d5aad

    • SHA256

      f35dbaff6f328daa836dcab2a80cf3efae4dd574788e153a7ecd27f52da9dee1

    • SHA512

      1cb935156a4506b89d5a9b27176f29634e2de9b2e5ab82a2c6050fc4bb85b50838f4d14e78e3165fd1d48006f2e3d9c48c40da79743f4982de179f35e7d3a804

    • SSDEEP

      3072:oT2lsEO4HsAUnK4q7crAa2JEnT1L6Ft5JgRMu63jXdo:59O4Ha1Gckq5mFpg6jX

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks