General

  • Target

    c75b4dca6b8b6a0dc76cd086ebce080c

  • Size

    222KB

  • Sample

    240314-b2ymmahf83

  • MD5

    c75b4dca6b8b6a0dc76cd086ebce080c

  • SHA1

    3206e844d0843db107582b6072f87a64810a5972

  • SHA256

    85fd0d293f29d7846d05f287a36ccf3306dde237d6da30afd89d9f04609bced0

  • SHA512

    58340318a1888208eab959c1431645728d24b8eb09ba1f2f0c44e414cb032e4c29938ea4ace4b733bd3ccc86dbc010a0ed7874dae5c4cd825d6288254a382c88

  • SSDEEP

    3072:zMT/A2zXmmnSsaIIL6q4boaNLJDwX8PcMslRsQj+MFzwbEu4HGszssldPu0bL:QpSMSfIIL6qaLyX8olrFzBnmytldWS

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Targets

    • Target

      c75b4dca6b8b6a0dc76cd086ebce080c

    • Size

      222KB

    • MD5

      c75b4dca6b8b6a0dc76cd086ebce080c

    • SHA1

      3206e844d0843db107582b6072f87a64810a5972

    • SHA256

      85fd0d293f29d7846d05f287a36ccf3306dde237d6da30afd89d9f04609bced0

    • SHA512

      58340318a1888208eab959c1431645728d24b8eb09ba1f2f0c44e414cb032e4c29938ea4ace4b733bd3ccc86dbc010a0ed7874dae5c4cd825d6288254a382c88

    • SSDEEP

      3072:zMT/A2zXmmnSsaIIL6q4boaNLJDwX8PcMslRsQj+MFzwbEu4HGszssldPu0bL:QpSMSfIIL6qaLyX8olrFzBnmytldWS

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks