General
- Target 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d
- Size 140KB
- Sample240221-fl8j4scc95
- SHA256 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d
- MD5 fcb0fb8bba03aa7272d74cf4fa222889
- SHA1 15ebe4683e9dca78d430a0b3e0ea2e824d947d70
- SHA512 0bebaa1ffad0fa62b99e3aea8e853d3fbe8c02af15661524db2bb2df0639343ae7d124e2464f098f0472cd1a65ee3bb0b54703b34703b17453c59550300fcfca
- SSDEEP 3072:yvBSZHsPMUKdL6tf6eT2UNGNquenY7+P:yvGMPMhF6t2nOn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe
Resource
win7-20231215-en
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe
Resource
win10-20240214-en
8 signatures
300 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://sjyey.com/tmp/index.php
-
http://babonwo.ru/tmp/index.php
-
http://mth.com.ua/tmp/index.php
-
http://piratia.pw/tmp/index.php
-
http://go-piratia.ru/tmp/index.php
rc4.i32
rc4.i32
Targets
-
- Target 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d
- Size 140KB
- SHA256 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d
- MD5 fcb0fb8bba03aa7272d74cf4fa222889
- SHA1 15ebe4683e9dca78d430a0b3e0ea2e824d947d70
- SHA512 0bebaa1ffad0fa62b99e3aea8e853d3fbe8c02af15661524db2bb2df0639343ae7d124e2464f098f0472cd1a65ee3bb0b54703b34703b17453c59550300fcfca
- SSDEEP 3072:yvBSZHsPMUKdL6tf6eT2UNGNquenY7+P:yvGMPMhF6t2nOn
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Deletes itself
-
Executes dropped EXE