Overview

overview

10

Static

static

3

f6c98dc4b4...18.exe

windows7-x64

10

f6c98dc4b4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6c98dc4b424a25f2f5ebb97108c9683_JaffaCakes118

  • Size

    355KB

  • Sample

    240417-29a5eaad5v

  • MD5

    f6c98dc4b424a25f2f5ebb97108c9683

  • SHA1

    5467f9cf7290a5d8920c2bc8b18087ef269c569c

  • SHA256

    21e4cba51fb11729777d887c9b2ecfab1d96ed68b77b742dd4cce03457bbae74

  • SHA512

    fd68843ca5117b89c932e210c2f43b4e7f7a3b4174c22f4551fd1d212d5012659124c40137d8cd95befdd2346a3092915b5f5cc3fdc355d9336e5f8fb57b5ba7

  • SSDEEP

    6144:hM1i+OhY5DKR2nipWHr0d125y+TYT5QQCCKz6Y:hiHKR2nip+r0T25y+TkQnCK

Score
10/10
smokeloaderpub2backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/
rc4.i32
rc4.i32

Targets

    • Target

      f6c98dc4b424a25f2f5ebb97108c9683_JaffaCakes118

    • Size

      355KB

    • MD5

      f6c98dc4b424a25f2f5ebb97108c9683

    • SHA1

      5467f9cf7290a5d8920c2bc8b18087ef269c569c

    • SHA256

      21e4cba51fb11729777d887c9b2ecfab1d96ed68b77b742dd4cce03457bbae74

    • SHA512

      fd68843ca5117b89c932e210c2f43b4e7f7a3b4174c22f4551fd1d212d5012659124c40137d8cd95befdd2346a3092915b5f5cc3fdc355d9336e5f8fb57b5ba7

    • SSDEEP

      6144:hM1i+OhY5DKR2nipWHr0d125y+TYT5QQCCKz6Y:hiHKR2nip+r0T25y+TkQnCK

    Score
    10/10
    smokeloaderpub2backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks