General

  • Target

    build2.exe

  • Size

    13KB

  • Sample

    240926-ktw89s1dlg

  • MD5

    a7416a6f5174d4e187a8425fbd03d083

  • SHA1

    e3b3571bf5f685e059e4deafda10767e8022b520

  • SHA256

    c8bb0b37a1d76c6614cd920da95a14a3abe7a6981306fbfb296b5e18a1c47d0b

  • SHA512

    d6255bb0d9c1cdf66a01942b96d9897d1e32ff78a019b52343079ea2f8dff04a79662f3eac687276d63c73fce0cd557b76b1d61ab2bc92badd1fd6a064f38d67

  • SSDEEP

    192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4OtkO:JAnLAXNy/m3/bTKkO

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://dogewareservice.ru/

Targets

    • Target

      build2.exe

    • Size

      13KB

    • MD5

      a7416a6f5174d4e187a8425fbd03d083

    • SHA1

      e3b3571bf5f685e059e4deafda10767e8022b520

    • SHA256

      c8bb0b37a1d76c6614cd920da95a14a3abe7a6981306fbfb296b5e18a1c47d0b

    • SHA512

      d6255bb0d9c1cdf66a01942b96d9897d1e32ff78a019b52343079ea2f8dff04a79662f3eac687276d63c73fce0cd557b76b1d61ab2bc92badd1fd6a064f38d67

    • SSDEEP

      192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4OtkO:JAnLAXNy/m3/bTKkO

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks