smokeloader

General

Target
9568547bd4692d7d6e06e107ebed3863.exe
Size 232KB
Sample220328-j4earsdchl
SHA256 93fc4f2ee5e58547ba2073c5475e846a13f9e98209732bd160f9f5b355b41bca
MD5 9568547bd4692d7d6e06e107ebed3863
SHA1 7006cb663c21814d2823eb488eb7eeb673bdaa46
SHA512 5aaf9d5f14fa96dd68214ca59a9af1efd243392e9397ee0b30874dd227fe10fe8e776767401b0de3d05d81f65c00560740de06103b1f419e2d3b08a7c3d44835
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/

rc4.i32

Targets

- Target
  9568547bd4692d7d6e06e107ebed3863.exe
- Size 232KB
- SHA256 93fc4f2ee5e58547ba2073c5475e846a13f9e98209732bd160f9f5b355b41bca
- MD5 9568547bd4692d7d6e06e107ebed3863
- SHA1 7006cb663c21814d2823eb488eb7eeb673bdaa46
- SHA512 5aaf9d5f14fa96dd68214ca59a9af1efd243392e9397ee0b30874dd227fe10fe8e776767401b0de3d05d81f65c00560740de06103b1f419e2d3b08a7c3d44835
- MD5 SHA1 SHA512
Score

10^/10

smokeloader backdoor trojan discovery suricata
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- suricata: ET MALWARE Danabot Key Exchange Request
  suricata: ET MALWARE Danabot Key Exchange Request
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

suricata: ET MALWARE Danabot Key Exchange Request

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Deletes itself

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2