Overview

overview

10

Static

static

8

b808673dcd...d5.exe

windows7_x64

10

b808673dcd...d5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b808673dcdb743f305fdfd4d6fd239d5.exe

  • Size

    212KB

  • Sample

    210106-z4bcc6dayx

  • MD5

    b808673dcdb743f305fdfd4d6fd239d5

  • SHA1

    dd57d842ebbfb390733f313b0b1e321b44c04d14

  • SHA256

    73bd0ef4821814fb351197b6967d35274f9f33de491faca434aeeb63a51072bb

  • SHA512

    67884616b51ab8be9a662b2890c9eb176748611d36512ba49b8b9f211da6db90646ff87d69b169615b83bc26f58c4ae13b428386137312e2711e0a6635759acf

Score
10/10
smokeloaderbackdoortrojanupx

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://mpmanagertzz.ru/

http://gmbshop.ru/

http://umnsystms.ug/

http://facepropertyzone.com/

http://ovenlumansera.ru/

http://vinimaxcopy.ru/

http://septembexisecel.ru/

http://wevivomboss.com/

http://baksproperty.gov.ug/

http://mossvivoweb.ru/
rc4.i32
rc4.i32

Targets

    • Target

      b808673dcdb743f305fdfd4d6fd239d5.exe

    • Size

      212KB

    • MD5

      b808673dcdb743f305fdfd4d6fd239d5

    • SHA1

      dd57d842ebbfb390733f313b0b1e321b44c04d14

    • SHA256

      73bd0ef4821814fb351197b6967d35274f9f33de491faca434aeeb63a51072bb

    • SHA512

      67884616b51ab8be9a662b2890c9eb176748611d36512ba49b8b9f211da6db90646ff87d69b169615b83bc26f58c4ae13b428386137312e2711e0a6635759acf

    Score
    10/10
    smokeloaderbackdoortrojanupx

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks