Overview

overview

10

Static

static

3

c8403bda5c...18.exe

windows7-x64

10

c8403bda5c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8403bda5c67d597b323d54f3431bad2_JaffaCakes118

  • Size

    211KB

  • Sample

    240829-fh8qpsvblb

  • MD5

    c8403bda5c67d597b323d54f3431bad2

  • SHA1

    4f10758b3680078c531c6eccd79d362eafb55088

  • SHA256

    1c42c9444b52b8b764a78eb9864fdda2e83bddec409ab3f002ffd809f1096ac8

  • SHA512

    806657488599ecbdd39f6171c0828422c8965374cfde9e8bdef05b19d52abd4c16f10f934bc09455b81ea7625e135bccb942ff68a5e5775f7e15f93cb72f7ba7

  • SSDEEP

    6144:iU5PpF9ESnrse5+sjrBrB4iLTQZ+Uo20K:iUvnrsIp3Br7LTk

Score
10/10
smokeloadersel1backdoordiscoverytrojan

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://renulistikass.net/

http://44youtuubering.net/

http://tuyuop44cu.top/

http://littlebigtovatu.net/

http://ulicamoiavdolidorogidoma.top/

http://liufuturist.top/

http://uyuduninast.top/
rc4.i32
rc4.i32

Extracted

Family

smokeloader

Botnet

sel1

Targets

    • Target

      c8403bda5c67d597b323d54f3431bad2_JaffaCakes118

    • Size

      211KB

    • MD5

      c8403bda5c67d597b323d54f3431bad2

    • SHA1

      4f10758b3680078c531c6eccd79d362eafb55088

    • SHA256

      1c42c9444b52b8b764a78eb9864fdda2e83bddec409ab3f002ffd809f1096ac8

    • SHA512

      806657488599ecbdd39f6171c0828422c8965374cfde9e8bdef05b19d52abd4c16f10f934bc09455b81ea7625e135bccb942ff68a5e5775f7e15f93cb72f7ba7

    • SSDEEP

      6144:iU5PpF9ESnrse5+sjrBrB4iLTQZ+Uo20K:iUvnrsIp3Br7LTk

    Score
    10/10
    smokeloaderbackdoordiscoverytrojansel1

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks