General

  • Target

    e32070f84919d59178bd08cfd39c9a4f_JaffaCakes118

  • Size

    317KB

  • Sample

    240406-ydkr7aha71

  • MD5

    e32070f84919d59178bd08cfd39c9a4f

  • SHA1

    f02c69af0907b7c7c434b23c6aa7746901ce4d05

  • SHA256

    c97f7b2a1d29e6ab8e802c3c814e1962452a9ab375a0f0c13ef6d4e4edefe9c2

  • SHA512

    d119b278fa397d3bc73c5ccdb8443bf1124e13e84f02ef00e22f3e33f4ffcb5b11dc0e3473265c56488086058360101c389d5fc4e65ecbebe66d0b388d9c0512

  • SSDEEP

    6144:a7ftKyYC4ckr61I74sGsmwK+JLcbD42Nwgh++qPFW8ThB:J7C4D21I749wh+Ddm0qI8T

Malware Config

Extracted

Family

smokeloader

Botnet

0308

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Targets

    • Target

      e32070f84919d59178bd08cfd39c9a4f_JaffaCakes118

    • Size

      317KB

    • MD5

      e32070f84919d59178bd08cfd39c9a4f

    • SHA1

      f02c69af0907b7c7c434b23c6aa7746901ce4d05

    • SHA256

      c97f7b2a1d29e6ab8e802c3c814e1962452a9ab375a0f0c13ef6d4e4edefe9c2

    • SHA512

      d119b278fa397d3bc73c5ccdb8443bf1124e13e84f02ef00e22f3e33f4ffcb5b11dc0e3473265c56488086058360101c389d5fc4e65ecbebe66d0b388d9c0512

    • SSDEEP

      6144:a7ftKyYC4ckr61I74sGsmwK+JLcbD42Nwgh++qPFW8ThB:J7C4D21I749wh+Ddm0qI8T

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks