General
- Target 68abca4995919db0fe3a4e9158062759b2267ebcd8e3036f7eb8e71ed6202c85
- Size 245KB
- Sample240226-ccvecaaa83
- SHA256 68abca4995919db0fe3a4e9158062759b2267ebcd8e3036f7eb8e71ed6202c85
- MD5 e654823683cb9be41044f5a800be69fd
- SHA1 d43214c03a47f3b0c77a82eca775d702eaa025e8
- SHA512 d20b18482b8f85bfa887495275712527939b388f912eac2388b2c446d4370a87118c01482898316b943667b2525b9b089d44e8e693cc6c5a6d9355ab2d9e6bcc
- SSDEEP 3072:Xw9eEIeQ1hQglTvIwiO6mdIvr970TwlX/q6W8rSbN/y55UWpyr7:gS2uvIwiO6mI96wlfWFbBDWpe
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68abca4995919db0fe3a4e9158062759b2267ebcd8e3036f7eb8e71ed6202c85.exe
Resource
win7-20240221-en
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
68abca4995919db0fe3a4e9158062759b2267ebcd8e3036f7eb8e71ed6202c85.exe
Resource
win10-20240221-en
8 signatures
300 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://sjyey.com/tmp/index.php
-
http://babonwo.ru/tmp/index.php
-
http://mth.com.ua/tmp/index.php
-
http://piratia.pw/tmp/index.php
-
http://go-piratia.ru/tmp/index.php
rc4.i32
rc4.i32
Targets
-
- Target 68abca4995919db0fe3a4e9158062759b2267ebcd8e3036f7eb8e71ed6202c85
- Size 245KB
- SHA256 68abca4995919db0fe3a4e9158062759b2267ebcd8e3036f7eb8e71ed6202c85
- MD5 e654823683cb9be41044f5a800be69fd
- SHA1 d43214c03a47f3b0c77a82eca775d702eaa025e8
- SHA512 d20b18482b8f85bfa887495275712527939b388f912eac2388b2c446d4370a87118c01482898316b943667b2525b9b089d44e8e693cc6c5a6d9355ab2d9e6bcc
- SSDEEP 3072:Xw9eEIeQ1hQglTvIwiO6mdIvr970TwlX/q6W8rSbN/y55UWpyr7:gS2uvIwiO6mI96wlfWFbBDWpe
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Deletes itself
-
Executes dropped EXE