Overview

overview

10

Static

static

23bef893e3...6b.exe

windows7_x64

23bef893e3...6b.exe

windows10_x64

Resubmissions

09/09/2020, 09:18

200909-ev13telmdn10

08/09/2020, 17:08

200908-br2a8ynnpn10

08/09/2020, 17:07

200908-2bbw72ekmn10

08/09/2020, 16:54

200908-qgbye23mhs10

08/09/2020, 16:46

200908-p5f4c5cdzj10

Sharing

Copy URL Twitter E-mail

General

  • Target
    23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b
  • Size 154KB
  • Sample200908-2bbw72ekmn
  • SHA256 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b
  • MD5 SHA1 SHA512
Score
10/10
smokeloaderbackdoorbootkitransomwaretrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://dkajsdjiqwdwnfj.info/

  • http://2831ujedkdajsdj.info/

  • http://928eijdksasnfss.info/

  • https://dkajsdjiqwdwnfj.info/

  • https://2831ujedkdajsdj.info/

  • https://928eijdksasnfss.info/

rc4.i32
rc4.i32

Targets

    • Target
      23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b
    • Size 154KB
    • SHA256 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbackdoorsmokeloaderransomwarebootkit

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks