General

  • Target

    d3f6217f66716d1b253b60365db8aa4c.exe

  • Size

    209KB

  • Sample

    240522-x62ezadg53

  • MD5

    d3f6217f66716d1b253b60365db8aa4c

  • SHA1

    d1e2bf928bce0f5a913b0de81a22272d1f051f5a

  • SHA256

    5c0bfb5d5f155f64c1af3cc3cd610fa6e3495ae2c3a8660c96ac9a7fb73eb749

  • SHA512

    5edaa19f69971e5201ba9f378fb19ba6e5fa481f9dded8eb9c1912db0a6ae87f8dcb75da49b428f1b48617423558a2d7ddc1dedfd8847fdc97189f6f9d25a98e

  • SSDEEP

    3072:VsUFZW1zxw2PfoScast12esP9+mSjiN69BibwQ8dsN7BrV0ncwmKqx7I1YS:lFw1ljPfojast12FFv69BrQPdtKoAY

Malware Config

Extracted

Family

smokeloader

Botnet

sel2

Extracted

Family

smokeloader

Version

2022

C2

https://airwide-land.com/calcroom.php

https://summerwaterhall.com/calcroom.php

rc4.i32
rc4.i32

Targets

    • Target

      d3f6217f66716d1b253b60365db8aa4c.exe

    • Size

      209KB

    • MD5

      d3f6217f66716d1b253b60365db8aa4c

    • SHA1

      d1e2bf928bce0f5a913b0de81a22272d1f051f5a

    • SHA256

      5c0bfb5d5f155f64c1af3cc3cd610fa6e3495ae2c3a8660c96ac9a7fb73eb749

    • SHA512

      5edaa19f69971e5201ba9f378fb19ba6e5fa481f9dded8eb9c1912db0a6ae87f8dcb75da49b428f1b48617423558a2d7ddc1dedfd8847fdc97189f6f9d25a98e

    • SSDEEP

      3072:VsUFZW1zxw2PfoScast12esP9+mSjiN69BibwQ8dsN7BrV0ncwmKqx7I1YS:lFw1ljPfojast12FFv69BrQPdtKoAY

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks