Overview

overview

10

Static

static

9ac835c38d...f1.exe

windows7_x64

10

9ac835c38d...f1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ac835c38d4d0c6466e641427a2cf8f1.exe

  • Size

    32KB

  • Sample

    210303-jkaqg444ya

  • MD5

    9ac835c38d4d0c6466e641427a2cf8f1

  • SHA1

    108a8b5f1eaf9ef078a3dc0210e6aa961d6b3787

  • SHA256

    b6ec96043dba7722cac4ed24b6979fc71a758bdf18ca44353c19194c172bf621

  • SHA512

    226480dc7c6d7f3eee39365e59cc317f203da475beb85d599fee3ae02d64306869eda37ee22076100b240904a2c15b53249efd0020deb6526639d49d4e236cc8

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://cfsmarthome.net/1/

rc4.i32
rc4.i32

Targets

    • Target

      9ac835c38d4d0c6466e641427a2cf8f1.exe

    • Size

      32KB

    • MD5

      9ac835c38d4d0c6466e641427a2cf8f1

    • SHA1

      108a8b5f1eaf9ef078a3dc0210e6aa961d6b3787

    • SHA256

      b6ec96043dba7722cac4ed24b6979fc71a758bdf18ca44353c19194c172bf621

    • SHA512

      226480dc7c6d7f3eee39365e59cc317f203da475beb85d599fee3ae02d64306869eda37ee22076100b240904a2c15b53249efd0020deb6526639d49d4e236cc8

    Score
    10/10
    smokeloaderbackdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks