General

  • Target

    363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

  • Size

    234KB

  • Sample

    240408-cx9prsec45

  • MD5

    ebe71b5ba13ea1a61f3473ef01036eb4

  • SHA1

    29a8e68384ecf60935a61b32b311002a620a85eb

  • SHA256

    363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

  • SHA512

    f4c7d5b3ee3d4d1e27ef85b58b877f0d033f31881e96cddab7fe845d487a2b1d575f6bb61caada912b8e2b0b17249eafa0cefabeaa1440805a85e76227112746

  • SSDEEP

    3072:+lzupUvMF2X7BHv1uhtw+LZiXhMFM4aNejxBykNwc45uhGg3eo0jCSETu:nWEF+7Bt/Akf44ePykuci+GDBjCSET

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32
rc4.i32

Targets

    • Target

      363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

    • Size

      234KB

    • MD5

      ebe71b5ba13ea1a61f3473ef01036eb4

    • SHA1

      29a8e68384ecf60935a61b32b311002a620a85eb

    • SHA256

      363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

    • SHA512

      f4c7d5b3ee3d4d1e27ef85b58b877f0d033f31881e96cddab7fe845d487a2b1d575f6bb61caada912b8e2b0b17249eafa0cefabeaa1440805a85e76227112746

    • SSDEEP

      3072:+lzupUvMF2X7BHv1uhtw+LZiXhMFM4aNejxBykNwc45uhGg3eo0jCSETu:nWEF+7Bt/Akf44ePykuci+GDBjCSET

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks