SmokeLoader

Modular backdoor trojan in use since 2014.

suricata: ET MALWARE ServHelper CnC Inital Checkin

suricata: ET MALWARE ServHelper CnC Inital Checkin

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Grants admin privileges

Uses net.exe to modify the user's privileges.

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies RDP port number used by Windows

Sets DLL path for service in the registry

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.