General
-
Target
2288f85ceef436fa4fc8ef65ec9dd510da34281dc5c03db642d40a35e20bbdc6
-
Size
296KB
-
Sample
240418-2cgwpage82
-
MD5
fb358104b0555ccd1d85d7aae3902f32
-
SHA1
1997af5b0fac706a937b35073b57dae4227fbbdc
-
SHA256
2288f85ceef436fa4fc8ef65ec9dd510da34281dc5c03db642d40a35e20bbdc6
-
SHA512
3c2345000bd6e11838bf81499fc68786886d0eb1a6760c5d5337baa62af219a6c0c2f6e4cae9aa69484bc05f3e3b9e850989ed54bf8fb5e44288bf2f7ad3b10f
-
SSDEEP
3072:mEgkNuL0W0pRGzvbqNFWLxwX8icKUoN9y8NG55+5KdObid4K1uIKF:lNuL+RkzU4FjKBN9lJ6Obimou
Static task
static1
Behavioral task
behavioral1
Sample
2288f85ceef436fa4fc8ef65ec9dd510da34281dc5c03db642d40a35e20bbdc6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2288f85ceef436fa4fc8ef65ec9dd510da34281dc5c03db642d40a35e20bbdc6.exe
Resource
win10-20240319-en
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Targets
-
-
Target
2288f85ceef436fa4fc8ef65ec9dd510da34281dc5c03db642d40a35e20bbdc6
-
Size
296KB
-
MD5
fb358104b0555ccd1d85d7aae3902f32
-
SHA1
1997af5b0fac706a937b35073b57dae4227fbbdc
-
SHA256
2288f85ceef436fa4fc8ef65ec9dd510da34281dc5c03db642d40a35e20bbdc6
-
SHA512
3c2345000bd6e11838bf81499fc68786886d0eb1a6760c5d5337baa62af219a6c0c2f6e4cae9aa69484bc05f3e3b9e850989ed54bf8fb5e44288bf2f7ad3b10f
-
SSDEEP
3072:mEgkNuL0W0pRGzvbqNFWLxwX8icKUoN9y8NG55+5KdObid4K1uIKF:lNuL+RkzU4FjKBN9lJ6Obimou
Score10/10-
Modifies Installed Components in the registry
-
Deletes itself
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-