Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Analysis of Smoke Loader in New Tsunami Campaign

Summary: Unit 42 reported a campaign that used a fake Japanese Meteorological Agency tsunami-warning email, written in fluent Japanese and sent narrowly, to deliver the Smoke Loader modular loader from a lookalike domain jma-go[.]jp registered on Oct 30, 2018. The loader builds a 40-character machine ID from the computer name, the static value 0B0D0406 and the volume serial number, encrypts C2 traffic with RC4, and in this campaign delivered a plugin with six modules aimed at stealing stored credentials and browser and FTP/email data; on Nov 25 the same URL began serving the AzoRult credential stealer.

Key Takeaway: The registrant of jma-go[.]jp, tied to a Russian postal address and a Gmail account, had registered eight other domains, three of which served the Marcher Android banking trojan in early 2018 - the same actor infrastructure now targets Japanese credentials, and the loader's per-machine encryption means identical payloads produce a different file hash on every host.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related