smokeloader

General

Target

e0059c4ad73116bf0ea29d575ea2c175.exe
Size

162KB
Sample

210329-grqc5qt2g2
MD5

e0059c4ad73116bf0ea29d575ea2c175
SHA1

a1316534bb8a3b52ec4f14d8c3172e49f6c5760f
SHA256

fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758
SHA512

b8a06dd6de28e6d29ebafe58bb6262412add147f01f3d3367dd7da95d083d92656e92a7bfce6a13179dc27b6ee346f5bcf98b0f067be2286a9cc741babd06de4

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://xsss99.icu/upload/

http://bingooodsg.icu/upload/

http://junntd.xyz/upload/

http://ginessa11.xyz/upload/

http://overplayninsx.xyz/upload/

http://bananinze.com/upload/

http://daunimlas.com/upload/

rc4.i32

Targets

- Target
  
  e0059c4ad73116bf0ea29d575ea2c175.exe
- Size
  
  162KB
- MD5
  
  e0059c4ad73116bf0ea29d575ea2c175
- SHA1
  
  a1316534bb8a3b52ec4f14d8c3172e49f6c5760f
- SHA256
  
  fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758
- SHA512
  
  b8a06dd6de28e6d29ebafe58bb6262412add147f01f3d3367dd7da95d083d92656e92a7bfce6a13179dc27b6ee346f5bcf98b0f067be2286a9cc741babd06de4
Score

10^/10

smokeloader taurus_stealer backdoor discovery persistence spyware stealer trojan tofsee bootkit evasion
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Taurus Stealer
  Taurus is an infostealer first seen in June 2020.
  trojan stealer taurus_stealer
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Creates new service(s)
  persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2