Overview

overview

10

Static

static

9fbd32c6bb...40.exe

windows7_x64

10

9fbd32c6bb...40.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fbd32c6bb25f6a660696fa9830c5040.exe

  • Size

    847KB

  • Sample

    210413-51ml2vj876

  • MD5

    9fbd32c6bb25f6a660696fa9830c5040

  • SHA1

    1e41347d36792e823a8982b10170d83a0722e3cc

  • SHA256

    5de2819f832f06f69009b07779eacabc1b171540b10689b4b23eaac8f3232e14

  • SHA512

    3b89b40676449390bfdc139aad1ac664cf14213eeed32dfa8e06671a8bcc97fe6facd42331657bdc220a9e38fee2021b1ea7a1c2ace6b89ec5d31d488eb2bdfb

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://u.teknik.io/28oLW.jpg

Extracted

Family

smokeloader

Version

2018

C2

http://94.140.115.43/1/

rc4.i32
rc4.i32

Targets

    • Target

      9fbd32c6bb25f6a660696fa9830c5040.exe

    • Size

      847KB

    • MD5

      9fbd32c6bb25f6a660696fa9830c5040

    • SHA1

      1e41347d36792e823a8982b10170d83a0722e3cc

    • SHA256

      5de2819f832f06f69009b07779eacabc1b171540b10689b4b23eaac8f3232e14

    • SHA512

      3b89b40676449390bfdc139aad1ac664cf14213eeed32dfa8e06671a8bcc97fe6facd42331657bdc220a9e38fee2021b1ea7a1c2ace6b89ec5d31d488eb2bdfb

    Score
    10/10
    smokeloaderbackdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks