General
-
Target
toolspab1.exe
-
Size
207KB
-
Sample
240428-3htm4scc2s
-
MD5
6e60f7145b20285790659ed9769b6692
-
SHA1
8491e703195ac2bd3238a578bdf361a4d7ea1c34
-
SHA256
446ef80525dac1376b4206100f0c937f358a9f8417a937e2a4d2511dc687bf5a
-
SHA512
da6b67b788423c79d0cd6375ae1acdab40b8c4abe6b52e9573385542b9d6bb8a6021576ce46d857b7988abe71de029105f192877f7835e6c546010e517b69088
-
SSDEEP
3072:dXNxnFqcLXdCOck2DLO5L0WhyTFGlU+x4i+nN4P/xjUD:Z3FqcLtL2LM0WhLlU7PO/N+
Static task
static1
Behavioral task
behavioral1
Sample
toolspab1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
toolspab1.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Targets
-
-
Target
toolspab1.exe
-
Size
207KB
-
MD5
6e60f7145b20285790659ed9769b6692
-
SHA1
8491e703195ac2bd3238a578bdf361a4d7ea1c34
-
SHA256
446ef80525dac1376b4206100f0c937f358a9f8417a937e2a4d2511dc687bf5a
-
SHA512
da6b67b788423c79d0cd6375ae1acdab40b8c4abe6b52e9573385542b9d6bb8a6021576ce46d857b7988abe71de029105f192877f7835e6c546010e517b69088
-
SSDEEP
3072:dXNxnFqcLXdCOck2DLO5L0WhyTFGlU+x4i+nN4P/xjUD:Z3FqcLtL2LM0WhLlU7PO/N+
Score10/10-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-