smokeloader | 5980c4aae31565e95b76b3150f92344edcdd8b84c5c7059afb804e0df14532bd | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004_x64

Sharing

General

Target

5980c4aae31565e95b76b3150f92344edcdd8b84c5c7059afb804e0df14532bd
Size

239KB
Sample

220127-kfdj1aabf7
MD5

3485f107a03b76035e7bdc254119f11e
SHA1

c7eec65666ddfe3527e35a56340a3e630e027b76
SHA256

5980c4aae31565e95b76b3150f92344edcdd8b84c5c7059afb804e0df14532bd
SHA512

8a72b13adb28f78322137214d40ea5da98b85b338cdf76cc2afc615381c0b77ccc25a093f7ab975c6336ab91014158dea37b5617b2c3558004fa609ac22632ed

Score

10^/10

smokeloader backdoor evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

5980c4aae31565e95b76b3150f92344edcdd8b84c5c7059afb804e0df14532bd.exe

Resource

win10v2004-en-20220112

smokeloader backdoor evasion persistence trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

https://oakland-studio.video/search.php

https://seattle-university.video/search.php

rc4.i32

rc4.i32

Targets

- Target
  
  5980c4aae31565e95b76b3150f92344edcdd8b84c5c7059afb804e0df14532bd
- Size
  
  239KB
- MD5
  
  3485f107a03b76035e7bdc254119f11e
- SHA1
  
  c7eec65666ddfe3527e35a56340a3e630e027b76
- SHA256
  
  5980c4aae31565e95b76b3150f92344edcdd8b84c5c7059afb804e0df14532bd
- SHA512
  
  8a72b13adb28f78322137214d40ea5da98b85b338cdf76cc2afc615381c0b77ccc25a093f7ab975c6336ab91014158dea37b5617b2c3558004fa609ac22632ed
Score

10^/10

smokeloader backdoor evasion persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Process Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorevasionpersistencetrojan

© 2018-2024

Terms | Privacy