Overview

overview

10

Static

static

load.exe

windows7_x64

10

load.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    load.exe

  • Size

    284KB

  • Sample

    210310-jg4w9raf82

  • MD5

    5ed271e10ba37319d01d44acd33489a7

  • SHA1

    7130a850b50d5fccc1401f57ad95cac863a02062

  • SHA256

    178fb69c394a6d86a3695acbb025bc2f3be31dea683ee6e5016af0566eef8111

  • SHA512

    882d1adf9f2513d5578a72dcc50f0ef510def30c2c1ed0af5f051752e299a72be79c48660038aa852a39007c8286c6ea2ba2886cf0d8e4a859573faedf1ca27f

Score
10/10
smokeloaderbackdoordiscoverytrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://jibw.top/

http://lakf.top/

http://yapv.top/

http://pqdb.top/

http://bpqx.top/

http://gyuw.top/

http://vafc.top/

http://qgam.top/

http://viio.top/

http://chpp.top/

http://csji.top/

http://xxql.top/

http://vtxa.top/

http://ggoz.top/

http://crpa.top/

http://vuss.top/

http://coal.top/

http://fymm.top/

http://roaf.top/

http://aeus.top/
rc4.i32
rc4.i32

Targets

    • Target

      load.exe

    • Size

      284KB

    • MD5

      5ed271e10ba37319d01d44acd33489a7

    • SHA1

      7130a850b50d5fccc1401f57ad95cac863a02062

    • SHA256

      178fb69c394a6d86a3695acbb025bc2f3be31dea683ee6e5016af0566eef8111

    • SHA512

      882d1adf9f2513d5578a72dcc50f0ef510def30c2c1ed0af5f051752e299a72be79c48660038aa852a39007c8286c6ea2ba2886cf0d8e4a859573faedf1ca27f

    Score
    10/10
    smokeloaderbackdoordiscoverytrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks