Smoke Loader Malware Has Returned

Smoke Loader has been operating for many months and was behind several high-profile attacks. You may remember earlier this year we talked about Smoke Loader (here) and how it was used alongside fake Spectre and Meltdown patches.

Cisco Talos has been tracking a new version of Smoke Loader, a malicious application that can be used to load other malware — for the past several months following an alert from Cisco Advanced Malware Protection’s (AMP) Exploit Prevention engine. AMP successfully stopped the malware before it was able to infect the host, but further analysis showed some developments in the Smoke Loader sample resulting from this chain of malware that intrigued us.

This includes one of the first uses of the PROPagate injection technique in real-world malware. Besides a report released at the end of last week describing a different RIG Exploit Kit-based campaign, we haven’t seen real-world malware using this.

Cisco Talos is very familiar with Smoke Loader. For example, it was used as a downloader for a cyberattack that was launched using the official website of Ukraine-based accounting software developer Crystal Finance Millennium (CFM) in January.

Similar to many other campaigns, the initial infection vector was an email with a malicious Microsoft Word document attached. The victims were tricked into opening the attachment and enabling the embedded macros. This started the malware-downloading chain, down to the final Smoke Loader infection and its plugins.

Smoke Loader is primarily used as a downloader to drop and execute additional malware like ransomware or cryptocurrency miners. Actors using Smoke Loader botnets have posted on malware forums attempting to sell third-party payload installs. This sample of Smoke Loader did not transfer any additional executables, suggesting that it may not be as popular as it once was, or it’s only being used for private purposes.

The plugins are all designed to steal sensitive information from the victim, specifically targeting stored credentials or sensitive information transferred over a browser — including Windows and Team Viewer credentials, email logins, and others.

Further details visit – https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more

Trickbot IPs:
185[.]174[.]173[.]34
162[.]247[.]155[.]114
185[.]174[.]173[.]116
185[.]174[.]173[.]241
62[.]109[.]26[.]121
185[.]68[.]93[.]27
137[.]74[.]151[.]148
185[.]223[.]95[.]66
85[.]143[.]221[.]60
195[.]123[.]216[.]115
94[.]103[.]82[.]216
185[.]20[.]187[.]13
185[.]242[.]179[.]118
62[.]109[.]26[.]208
213[.]183[.]51[.]54
62[.]109[.]24[.]176
62[.]109[.]27[.]196
185[.]174[.]174[.]156
37[.]230[.]112[.]146
185[.]174[.]174[.]72

Smoke Loader domains:
ukcompany[.]me
ukcompany[.]pw
ukcompany[.]top

Story and image via Cisco Talos