General
-
Target
dc7c1bf583939fef10df9f038b60fc24.exe
-
Size
136KB
-
Sample
201229-rqkgknwn4j
-
MD5
dc7c1bf583939fef10df9f038b60fc24
-
SHA1
137b8059a231dba8c654771b09db028a9e72f20c
-
SHA256
430ff3dba43b7a63c4a04a52bf6794044a86c0084843c9f115118e789982bed6
-
SHA512
8950ed2fd5f76e23158cb39e48dd2502bec75cb8297731406a10ff787cc8ed4811caae0b022921c929250bdefaf0534ec9836e106a346cce7391f6989c37d1c1
Static task
static1
Behavioral task
behavioral1
Sample
dc7c1bf583939fef10df9f038b60fc24.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
dc7c1bf583939fef10df9f038b60fc24.exe
Resource
win10v20201028
Malware Config
Extracted
smokeloader
2020
http://vtdilet.com/upload/
http://netvxi.com/upload/
http://tinnys.monster/upload/
Targets
-
-
Target
dc7c1bf583939fef10df9f038b60fc24.exe
-
Size
136KB
-
MD5
dc7c1bf583939fef10df9f038b60fc24
-
SHA1
137b8059a231dba8c654771b09db028a9e72f20c
-
SHA256
430ff3dba43b7a63c4a04a52bf6794044a86c0084843c9f115118e789982bed6
-
SHA512
8950ed2fd5f76e23158cb39e48dd2502bec75cb8297731406a10ff787cc8ed4811caae0b022921c929250bdefaf0534ec9836e106a346cce7391f6989c37d1c1
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-