smokeloader | dd3720789e178c7c7eacf0e52579750c857d8b5b5280d9efb919270d45839e1b | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10_x64

Sharing

General

Target

dd3720789e178c7c7eacf0e52579750c857d8b5b5280d9efb919270d45839e1b
Size

316KB
Sample

220125-l69wkadgan
MD5

4d4ea19eb08d29421236a68b7d83e6c8
SHA1

7666efddd5ebd9ed827d7ea677d4df7a7bdcfc3f
SHA256

dd3720789e178c7c7eacf0e52579750c857d8b5b5280d9efb919270d45839e1b
SHA512

fdcbf3ebaf9d4a5c8420ed9fb101795665302c76cbfc50681cebd349f58ceb37cf1063ce5edc6a1bcb26497c4569a373607fec5d05978d0483a1a42b3d028b06

Score

10^/10

smokeloader backdoor collection evasion suricata trojan

Static task

static1

Behavioral task

behavioral1

Sample

dd3720789e178c7c7eacf0e52579750c857d8b5b5280d9efb919270d45839e1b.exe

Resource

win10-en-20211208

smokeloader backdoor collection evasion suricata trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

https://oakland-studio.video/search.php

https://seattle-university.video/search.php

rc4.i32

rc4.i32

Targets

- Target
  
  dd3720789e178c7c7eacf0e52579750c857d8b5b5280d9efb919270d45839e1b
- Size
  
  316KB
- MD5
  
  4d4ea19eb08d29421236a68b7d83e6c8
- SHA1
  
  7666efddd5ebd9ed827d7ea677d4df7a7bdcfc3f
- SHA256
  
  dd3720789e178c7c7eacf0e52579750c857d8b5b5280d9efb919270d45839e1b
- SHA512
  
  fdcbf3ebaf9d4a5c8420ed9fb101795665302c76cbfc50681cebd349f58ceb37cf1063ce5edc6a1bcb26497c4569a373607fec5d05978d0483a1a42b3d028b06
Score

10^/10

smokeloader backdoor collection evasion suricata trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
  suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
  suricata
- suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
  suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
  suricata
- Modifies Windows Firewall
  evasion
- Deletes itself
- Accesses Microsoft Outlook profiles
  collection
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorcollectionevasionsuricatatrojan

© 2018-2024

Terms | Privacy