General

  • Target

    leal.exe

  • Size

    13KB

  • Sample

    250108-hldqva1ler

  • MD5

    ba95440d34e9b234431a2544d2da4cf8

  • SHA1

    6c7d8e4a9fc4f430a034c240912ba7ab391fd93f

  • SHA256

    b7c226784d87fd02de003567bc145cd42d4a0b80e2013a359f034cf12267ab4e

  • SHA512

    e390f04067017650579ddbcb09a1d8d74c89a20d0859b46054c73761f28e9698f8010a294e279284a2f318bc5fe9324ec4037e7da5bc0ef87a3043bc494fd7c7

  • SSDEEP

    192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4Ot2OO:JAnLAXNy/m3/bTK2O

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://dogewareservice.ru/

Targets

    • Target

      leal.exe

    • Size

      13KB

    • MD5

      ba95440d34e9b234431a2544d2da4cf8

    • SHA1

      6c7d8e4a9fc4f430a034c240912ba7ab391fd93f

    • SHA256

      b7c226784d87fd02de003567bc145cd42d4a0b80e2013a359f034cf12267ab4e

    • SHA512

      e390f04067017650579ddbcb09a1d8d74c89a20d0859b46054c73761f28e9698f8010a294e279284a2f318bc5fe9324ec4037e7da5bc0ef87a3043bc494fd7c7

    • SSDEEP

      192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4Ot2OO:JAnLAXNy/m3/bTK2O

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Smokeloader family

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks