General
- Target SecuriteInfo.com.Win32.PWSX-gen.16966.19531.exe
- Size 325KB
- Sample240412-ja8yaagg24
- SHA256 0b3d482dd4c05dafe53de7afbef7d8d13a62c687a7e705c212fcfe536ec22d9e
- MD5 c009d4d9d319cf4e11aa99b6d57fb433
- SHA1 448d7e0994c44bb56f95e9073891ccd5c6d51a86
- SHA512 8ddb8ae2b808cbf2a459b3ea21573e2eed8b362b8558610beeff77013a7b9de8889c7b55a8e97a01c7988cdde4a91dfd523ab84b2ab9766f242a0b734eb77635
- SSDEEP 3072:W7oggIL3mnqnjGt4RI5BnqV6olpiaRqUQ5iru5y7qQ:W7HgIL3WqjGt4RiRqV6OlqUuku5yW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.16966.19531.exe
Resource
win7-20240221-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.16966.19531.exe
Resource
win10v2004-20240226-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://nidoe.org/tmp/index.php
-
http://sodez.ru/tmp/index.php
-
http://uama.com.ua/tmp/index.php
-
http://talesofpirates.net/tmp/index.php
rc4.i32
rc4.i32
Targets
-
- Target SecuriteInfo.com.Win32.PWSX-gen.16966.19531.exe
- Size 325KB
- SHA256 0b3d482dd4c05dafe53de7afbef7d8d13a62c687a7e705c212fcfe536ec22d9e
- MD5 c009d4d9d319cf4e11aa99b6d57fb433
- SHA1 448d7e0994c44bb56f95e9073891ccd5c6d51a86
- SHA512 8ddb8ae2b808cbf2a459b3ea21573e2eed8b362b8558610beeff77013a7b9de8889c7b55a8e97a01c7988cdde4a91dfd523ab84b2ab9766f242a0b734eb77635
- SSDEEP 3072:W7oggIL3mnqnjGt4RI5BnqV6olpiaRqUQ5iru5y7qQ:W7HgIL3WqjGt4RiRqV6OlqUuku5yW
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Deletes itself
-
Executes dropped EXE