cyber.hendryadrian.com
Threat Research · hunt.io

Open Directories Expose SmokeLoader Campaign Using Ukrainian Banking and Auto Lures

· Original article ↗

Summary

Researchers found SmokeLoader samples and fake invoice and bank-statement PDFs in two open directories, revealing staging infrastructure and technical details of a campaign targeting Ukrainian organizations.

Key points

  • Two open directories hosted SmokeLoader executables and financial-themed PDF lures aimed at Ukrainian organizations.
  • The lures impersonated Ukrainian auto importer Ilta, Raiffeisen Bank, and Sense Bank.
  • The second directory shared three executables with the first and also contained a file named putty.exe.
  • Analysis found SmokeLoader injecting into explorer.exe, copying itself to AppData, and communicating with command-and-control servers over HTTP POST.
  • Requests used dynamically changing Referer headers generated from domain-generation-algorithm domains.
  • Researchers observed no additional payloads during their analysis; the article provides network and file indicators of compromise.

Article Details

Attack Vectors
  • SmokeLoader samples were staged on exposed open directories alongside financial-themed PDF lures impersonating Ukrainian businesses and banks.
  • The article says the PDF lures were likely distributed in a phishing operation to prompt recipients to open them and execute SmokeLoader.
  • A putty.exe file was found alongside the samples; the article suggests it may have been intended to deceive users seeking the legitimate SSH client.
Defensive Notes
  • Monitor for SmokeLoader activity, including process injection into explorer.exe and a duplicate named hbasjiu in the AppData directory.
  • Monitor network traffic for SmokeLoader HTTP POST communications to the listed C2 infrastructure and requests with dynamically changing Referer values generated from DGA domains.
  • Search for the listed file hashes and malicious infrastructure; the article reports that no additional payloads were observed during its analysis.

Indicators of compromise

TypeIndicatorContext
DOMAINconnecticutproperty[.]ruHardcoded in SmokeLoader's configuration as an infrastructure domain.
DOMAINconstractionscity1991[.]latHardcoded in SmokeLoader's configuration and listed among domains associated with known C2 infrastructure.
DOMAINconsultationoffice[.]ruListed as a domain associated with the known SmokeLoader C2 infrastructure.
DOMAINdownloadmanager[.]ruListed as a domain associated with the known SmokeLoader C2 infrastructure.
DOMAINfileexportinc[.]ruListed as a domain associated with the known SmokeLoader C2 infrastructure.
DOMAINns2[.]constractionscity1991[.]latReported to have resolved to 66.63.187[.]25 in late December 2024 as part of the SmokeLoader infrastructure.
DOMAINoncomnigos[.]ruListed as a domain associated with the known SmokeLoader C2 infrastructure.
DOMAINrestructurisationservice[.]ruHardcoded in SmokeLoader's configuration and also listed among domains associated with known C2 infrastructure.
DOMAINwww[.]connecticutproperty[.]ruDomain reported to resolve to the staging server and associated with the SmokeLoader infrastructure.
DOMAINwww[.]fileexportinc[.]ruListed as a domain associated with the known SmokeLoader C2 infrastructure.
DOMAINwww[.]spotcarservice[.]ruListed as a domain associated with the known SmokeLoader C2 infrastructure.
IPV42[.]59[.]163[.]172Exposed open directory hosting SmokeLoader samples and lure PDFs.
IPV42[.]59[.]163[.]71SmokeLoader command-and-control server.
IPV466[.]63[.]187[.]25Address to which the article says constractionscity1991[.]lat and ns2.constractionscity1991[.]lat resolved in late December 2024.
IPV488[.]151[.]192[.]50Second staging server reported to host the same Windows executables and lure files.
IPV488[.]151[.]192[.]71Address listed in the IOC table for a server sharing Windows executables with the 2.59.163[.]172 staging server.
IPV494[.]156[.]177[.]72SmokeLoader command-and-control server.
SHA2561118a93cc63a70ba8348182f7012ddbeecf890345941c82376ac967faf55a295SHA-256 hash listed for svc1.exe found in the staging directories.
SHA2564b00565a29eeb0446393d0538e8f24de232339cf3ffb6a76a2bce3ba160c2066SHA-256 hash listed for svc2.exe found in the staging directories.
SHA2565e7602b9073b8cf5c1a6afc6d0c8366545da65d2b48eb109f1bd9f40a58e73c0SHA-256 hash listed for the invoce.pdf lure found in a staging directory.
SHA2567991bfff4eb5f50aa9f5d3d95064411987a29de9621fc5afca9e4978ca568941SHA-256 hash listed for the invoce2.pdf lure found in a staging directory.
SHA2569833cbd22fd50181f8939114920e883bacf8d727337f5dcdf4450d0312eca188SHA-256 hash listed for the invoce415.pdf lure found with SmokeLoader samples.
SHA256f8bd5f0408409ea63a270d5aad8da5f0cb557f9a82e0da3e8077cbe589288054SHA-256 hash listed for the svc.exe and putty.exe files found in the staging directories.

MITRE ATT&CK

T1055 · Process InjectionThe article reports that SmokeLoader injects into explorer.exe once executed.T1071.001 · Web ProtocolsSmokeLoader communicates with its listed command-and-control servers using HTTP POST requests.T1568.002 · Domain Generation AlgorithmsThe article says dynamically changing Referer values in requests were generated from domain generation algorithm domains.

Malware

SmokeLoaderHunt researchers identified an open directory hosting SmokeLoader samples alongside lure documents targeting Ukraine's automotive and banking sectors. A second related directory contained the same malware but with

Products

AttackCapture

Countries

Polandan exposed server at 2.59.163[.]172, hosted on the Global Connectivity Solutions LLP network in Poland. The directory contained multiple Windows executables and PDF files labeled "invoce," a likelyUkraineresearchers identified an open directory hosting SmokeLoader samples alongside lure documents targeting Ukraine's automotive and banking sectors. A second related directory contained the same malware but with

Industries

Automotiveidentified an open directory hosting SmokeLoader samples alongside lure documents targeting Ukraine's automotive and banking sectors. A second related directory contained the same malware but with different lures,Bankingopen directory hosting SmokeLoader samples alongside lure documents targeting Ukraine's automotive and banking sectors. A second related directory contained the same malware but with different lures, suggesting a

Related Articles