2019/10/24 Smokeloader payloads

2019-10-24
#Smokeloader -> Payloads

#Amadey
#CrySis(#Dharma) #Ransomware
#Danabot
#DarkRat
#Gozi(#Ursnif)/(#Dreambot)
#Kronos
#Predator
#Quasar
#Raccoon
#Smokeloader
#Vidar

[Example Payload]
https://app.any.run/tasks/59bf16be-0c99-43f7-954c-94f952f5eb84/
https://app.any.run/tasks/9c77ec66-4d42-48be-ae11-2c97a9d2e528

[Reference]
https://twitter.com/tkanalyst/status/1186466461952307200

[MD5/Filename]
1d38d948d2866be25c047e5bae875a4d	/atx555mx.exe
41b93173a8b5583daaf090438fb05004	/chapo777.exe
685c5b13f23f9d71256b146640ac0845	/crot777amx.exe
136fae97d28f7dc1c275d52fdb885949	/crot777mx.dll
565a67a6dff8d567038d9fe8c7fa0024	/dan777.exe
4a6afd3c6793159cd1cfe99c7992b45a	/del777pmx.exe
f56fe35f81abb2517e497703e1559b11	/dmx777.exe
a9aef357bfe0d4c56b13f69b2af2edcd	/dmx777amx.exe
c3defbd7fffd387d09be5347ec1a83a1	/dor.exe
5080da8c8b6543f33a4ce740a7b0a35c	/dos777.exe
2d2a72236628870121ae36241664026c	/elin.exe
aebb648f75ee34f421d9c2ffd7f96623	/elin.exe.1
aebb648f75ee34f421d9c2ffd7f96623	/elin2.exe
c3613bd934dde67b05ba3983fba2bdfd	/evi111.exe
b21cdb0f3ab6db4fa676effbaef89b9d	/evi999.exe
2c058358db86ad7c423ec6e727136724	/gab.exe
339800289e29184eef7c6436b5e7e9dd	/guc.exe
526ac6eabc862493d32ab7a92408c600	/hrd777.exe
41adac5968f0c21377daea9dff7782a6	/isb777amx.exe
3266feb35d1eaa9697dd2e000b0ce18c	/kam.exe
7997b7fbe2f3bad42a2af2e080eccbf3	/kudes.exe
dc3a81cc4f57944f8769d3af969c3a80	/ntm.exe
eb633b7b53815cbe4c12d061063e76ce	/pak.exe
b8eb69bc32720f8e99431772e3ffec9b	/ph.exe
343755891370560b0ac9d35857aa4927	/pred777amx.exe
ca3a588b37335dd3f7ce8a3ea480946b	/pred999.exe
cc47bc788a58c510b00a5b288769a943	/skd.exe
f267d07c82912e0222666aa2cdc4cbee	/slot.exe
55952f9ebac7118bd88a354c75458935	/socks111.dll
5662239c0f3bb4ba40f6b7ca2524443b	/socks111.exe
97016d4b1321bd07c16f9f1304584ce4	/socks111atx.exe
3d724b6268417a84fc30c8d324b64397	/socks777.exe
13c2b020c1fec6f7497e180f59780a01	/socks777amx.exe
7a4af18d561a31a156762b6cf01b981e	/tap.exe
85ae6322075411aa058d86bba298d96f	/vodka.exe

[Comment]
The difference from the previous (2019/10/22) is as follows.

1d38d948d2866be25c047e5bae875a4d	/atx555mx.exe
685c5b13f23f9d71256b146640ac0845	/crot777amx.exe
f56fe35f81abb2517e497703e1559b11	/dmx777.exe
a9aef357bfe0d4c56b13f69b2af2edcd	/dmx777amx.exe
5080da8c8b6543f33a4ce740a7b0a35c	/dos777.exe
aebb648f75ee34f421d9c2ffd7f96623	/elin.exe.1
aebb648f75ee34f421d9c2ffd7f96623	/elin2.exe
41adac5968f0c21377daea9dff7782a6	/isb777amx.exe
7997b7fbe2f3bad42a2af2e080eccbf3	/kudes.exe
343755891370560b0ac9d35857aa4927	/pred777amx.exe
97016d4b1321bd07c16f9f1304584ce4	/socks111atx.exe
13c2b020c1fec6f7497e180f59780a01	/socks777amx.exe