General

  • Target

    fa371744e181b2857a6038e1bca60fff_JaffaCakes118

  • Size

    279KB

  • Sample

    240419-nr2mrabe4y

  • MD5

    fa371744e181b2857a6038e1bca60fff

  • SHA1

    cfb4083f31532b7195bef15eefc88147162379b6

  • SHA256

    92e576963128d956b98f423af33a3a2395e6a16f7d44855cfc2fff71c0651329

  • SHA512

    e8a44b47ee3d009660717137cb1a9072eb6ef3bed52cad86c55c9b09b1136849be23eab785f26334626d0b26d09fa9df8680cb138a4c351cb8043912b2521f13

  • SSDEEP

    6144:EH5wJRkIUpk/6VIxXZyls41SHX3UbsjzGlrkuM3c6:18IUy/6VIrylsy6zerN6

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/

rc4.i32
rc4.i32

Targets

    • Target

      fa371744e181b2857a6038e1bca60fff_JaffaCakes118

    • Size

      279KB

    • MD5

      fa371744e181b2857a6038e1bca60fff

    • SHA1

      cfb4083f31532b7195bef15eefc88147162379b6

    • SHA256

      92e576963128d956b98f423af33a3a2395e6a16f7d44855cfc2fff71c0651329

    • SHA512

      e8a44b47ee3d009660717137cb1a9072eb6ef3bed52cad86c55c9b09b1136849be23eab785f26334626d0b26d09fa9df8680cb138a4c351cb8043912b2521f13

    • SSDEEP

      6144:EH5wJRkIUpk/6VIxXZyls41SHX3UbsjzGlrkuM3c6:18IUy/6VIrylsy6zerN6

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks