smokeloader | 971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004_x64

Sharing

General

Target

971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849
Size

334KB
Sample

220126-eaachafcc7
MD5

1c03d828f8851eca3faa34e9fc7fc202
SHA1

18309ec6c815702007e405e89834e2a06973b0ee
SHA256

971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849
SHA512

5b0e4cadf471a562b3f0df08c6fd3870b4e1c454029bde23186cd6cb2b6dfa8d4278d2fb1c15bb9baa3126df7cf1ea3fb55d6923d6ec486e65ac824269bdee09

Score

10^/10

smokeloader backdoor evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849.exe

Resource

win10v2004-en-20220112

smokeloader backdoor evasion persistence trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

https://oakland-studio.video/search.php

https://seattle-university.video/search.php

rc4.i32

rc4.i32

Targets

- Target
  
  971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849
- Size
  
  334KB
- MD5
  
  1c03d828f8851eca3faa34e9fc7fc202
- SHA1
  
  18309ec6c815702007e405e89834e2a06973b0ee
- SHA256
  
  971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849
- SHA512
  
  5b0e4cadf471a562b3f0df08c6fd3870b4e1c454029bde23186cd6cb2b6dfa8d4278d2fb1c15bb9baa3126df7cf1ea3fb55d6923d6ec486e65ac824269bdee09
Score

10^/10

smokeloader backdoor evasion persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Process Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorevasionpersistencetrojan

© 2018-2024

Terms | Privacy