Analysis of Smoke Loader in New Tsunami Campaign
AI summary · glm-5.3-flashSummaries by Vani AI
Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.
A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.
Key facts
- Fake Japanese Meteorological Agency tsunami warning emails lured victims to a link delivering Smoke Loader.
- Smoke Loader is modular and has delivered banking trojans, ransomware, cryptominers, and PoS malware since 2011.
- New variants add junk-jump obfuscation, encrypted traffic, unique-ID-based payload encryption, and PROPagate injection into explorer.exe.
- The attacker registered a fake agency domain with a file path mimicking the legitimate website.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.001 User Execution: Malicious LinkT1055 Process InjectionT1027 Obfuscated Files or InformationT1547.001 Registry Run Keys / Startup Folder
- Malware
- Smoke LoaderAzoRultRetefe
- Victims
- Japan Meteorological Agency
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | jma-go.jp | n Smoke Loader contains the following hardcoded C2 address. jma-go[.]jp/js/metrology/jma.php An outline of initial C2 communicati |
| domain | mountainhigh.at | 5e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a |
| domain | racemodel.at | ae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50 |
| domain | sungmap.at | re yet. Following is the sample list. Domain Marcher SHA256 Sungmap[.]at 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb |
| domain | thunderbolt-price.com | . The attacker distributes those files from following URLs. thunderbolt-price[.]com/Art-and-Jakes/Coupon.scr bite-me.wz[.]cz/1.exe thunderbol |
| domain | wz.cz | s. thunderbolt-price[.]com/Art-and-Jakes/Coupon.scr bite-me.wz[.]cz/1.exe thunderbolt-price[.]com was registered in 2012 in J |
| ipv4 | 101.226.79.205 | her attack by the threat. 192.71.245[.]208 58.251.121[.]110 101.226.79[.]205 188.165.200[.]156 185.121.177[.]177 185.121.177[.]53 144. |
| ipv4 | 144.76.133.38 | [.]205 188.165.200[.]156 185.121.177[.]177 185.121.177[.]53 144.76.133[.]38 169.239.202[.]202 5.135.183[.]146 193.183.98[.]66 51.254. |
| ipv4 | 149.129.135.53 | address associates with jma-go[.]jp from 47.74.255[.]111 to 149.129.135[.]53 Dec 3, 2018 AzoRult7 48c94bfdb94b322c876114fcf55a6043f1cd |
| ipv4 | 169.239.202.202 | 00[.]156 185.121.177[.]177 185.121.177[.]53 144.76.133[.]38 169.239.202[.]202 5.135.183[.]146 193.183.98[.]66 51.254.25[.]115 51.255.48 |
| ipv4 | 185.121.177.177 | 5[.]208 58.251.121[.]110 101.226.79[.]205 188.165.200[.]156 185.121.177[.]177 185.121.177[.]53 144.76.133[.]38 169.239.202[.]202 5.135. |
| ipv4 | 185.121.177.53 | [.]110 101.226.79[.]205 188.165.200[.]156 185.121.177[.]177 185.121.177[.]53 144.76.133[.]38 169.239.202[.]202 5.135.183[.]146 193.183 |
| ipv4 | 188.165.200.156 | threat. 192.71.245[.]208 58.251.121[.]110 101.226.79[.]205 188.165.200[.]156 185.121.177[.]177 185.121.177[.]53 144.76.133[.]38 169.23 |
| ipv4 | 192.71.245.208 | IP addresses just in case for another attack by the threat. 192.71.245[.]208 58.251.121[.]110 101.226.79[.]205 188.165.200[.]156 185.1 |
| ipv4 | 193.183.98.66 | .177[.]53 144.76.133[.]38 169.239.202[.]202 5.135.183[.]146 193.183.98[.]66 51.254.25[.]115 51.255.48[.]78 |
| ipv4 | 47.74.255.111 | 018 Changes the IP address associates with jma-go[.]jp from 47.74.255[.]111 to 149.129.135[.]53 Dec 3, 2018 AzoRult7 48c94bfdb94b322c |
| ipv4 | 51.254.25.115 | .133[.]38 169.239.202[.]202 5.135.183[.]146 193.183.98[.]66 51.254.25[.]115 51.255.48[.]78 |
| ipv4 | 51.255.48.78 | 9.202[.]202 5.135.183[.]146 193.183.98[.]66 51.254.25[.]115 51.255.48[.]78 |
| ipv4 | 5.135.183.146 | 77[.]177 185.121.177[.]53 144.76.133[.]38 169.239.202[.]202 5.135.183[.]146 193.183.98[.]66 51.254.25[.]115 51.255.48[.]78 |
| ipv4 | 58.251.121.110 | in case for another attack by the threat. 192.71.245[.]208 58.251.121[.]110 101.226.79[.]205 188.165.200[.]156 185.121.177[.]177 185. |
| md5 | 41ee612602833345fc5bd2b98103811c | hash value of the string, MD5("Test_PC0B0D040612345678") = 41EE612602833345FC5BD2B98103811C It then appends the volume serial to the hash value and get |
| sha1 | 41ee612602833345fc5bd2b98103811c12345678 | ique ID. "41EE612602833345FC5BD2B98103811C" + "12345678" = "41EE612602833345FC5BD2B98103811C12345678" Next, Smoke Loader generates two strings based on the firs |
| sha256 | 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 | b36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b6 |
| sha256 | 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 | wing is the sample list. Domain Marcher SHA256 Sungmap[.]at 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772 |
| sha256 | 27aa9cdf60f1fbff84ede0d77bd49677ec346af050ffd90a43b8dcd528c9633b | c38d022e2b2d7bb7f8f9800b534b60183c Nov 8, 2018 Smoke Loader 27aa9cdf60f1fbff84ede0d77bd49677ec346af050ffd90a43b8dcd528c9633b Nov 9, 2018 Smoke Loader 42fdaffdbacfdf85945bd0e8bfaadb765d |
| sha256 | 3d75eabb8460450a49e2fb68053d9f591efe5aefd379205e5cc3af574bb9f415 | 2018 Registers jma-go[.]jp domain Nov 5, 2018 Smoke Loader 3d75eabb8460450a49e2fb68053d9f591efe5aefd379205e5cc3af574bb9f415 Nov 6, 2018 Smoke Loader 8a1aab36c3940e4dd83f489432fa710fba |
| sha256 | 42fdaffdbacfdf85945bd0e8bfaadb765dde622a0a7268f8aa70cd18c91a0e85 | 77ec346af050ffd90a43b8dcd528c9633b Nov 9, 2018 Smoke Loader 42fdaffdbacfdf85945bd0e8bfaadb765dde622a0a7268f8aa70cd18c91a0e85 Nov 15, 2018 Smoke Loader fb3def9c23ba81f85aae0f563f4156ba9 |
| sha256 | 55ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50dddbda8 | c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50dddbda8 Table 3 Domains and Marcher hashes On November 25, we confi |
| sha256 | 70900b5777ea48f4c635f78b597605e9bdbbee469b3052f1bd0088a1d18f85d3 | 4156ba9453c2e928728283de4abdfb5b5f426f Nov 24, 2018 AzoRult 70900b5777ea48f4c635f78b597605e9bdbbee469b3052f1bd0088a1d18f85d3 Nov 25, 2018 Smoke Loadera 1ce72ec2f2fe6139eb6bb35b8a4fb40a |
| sha256 | 7337143e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7 | a4fb40aca2d90bc19872d6517a6ebb66b6b139 Nov 27, 2018 AzoRult 7337143e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7 Nov 30, 2018 Changes the IP address associates with jma-go[ |
| sha256 | 748c94bfdb94b322c876114fcf55a6043f1cd612766e8af1635218a747f45fb9 | 43e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7 748c94bfdb94b322c876114fcf55a6043f1cd612766e8af1635218a747f45fb9 Marcher Samples 55ae2b00234674d82dcc401a0daa97e7b3921057a07 |
| sha256 | 75edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a | cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a079 |
| sha256 | 8a1aab36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d | 591efe5aefd379205e5cc3af574bb9f415 Nov 6, 2018 Smoke Loader 8a1aab36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc2 |
| sha256 | a1ce72ec2f2fe6139eb6bb35b8a4fb40aca2d90bc19872d6517a6ebb66b6b139 | f9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f a1ce72ec2f2fe6139eb6bb35b8a4fb40aca2d90bc19872d6517a6ebb66b6b139 AzoRult Samples 70900b5777ea48f4c635f78b597605e9bdbbee469b3 |
| sha256 | be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b60183c | d1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b60183c Nov 8, 2018 Smoke Loader 27aa9cdf60f1fbff84ede0d77bd49677ec |
| sha256 | fb3def9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f | 65dde622a0a7268f8aa70cd18c91a0e85 Nov 15, 2018 Smoke Loader fb3def9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f Nov 24, 2018 AzoRult 70900b5777ea48f4c635f78b597605e9bdbbee |
From the original article
9 min read at unit42.paloaltonetworks.com
On November 8th, the Japanese Meteorological Agency issued an alert about a fake tsunami warning email masquerading as coming from the agency. According to the alert, the email was written in Japanese and asked recipients to click the link to confirm their evacuation area from a tsunami after an earthquake.
By Kaoru Hayashi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.