Overview

overview

10

Static

static

450fe551f9...10.exe

windows10-2004_x64

10

Resubmissions

17-04-2022 03:41

220417-d8wgyshebj 10

17-04-2022 02:12

220417-cm7seshbgq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    450fe551f9989c51ae6b8ad556b22c4f34076f1cc61d2ffdfab5c55522d6e210

  • Size

    231KB

  • Sample

    220417-d8wgyshebj

  • MD5

    f37caf1332fe729273767e8839d95abc

  • SHA1

    485fc320582b7c2ce5f9ec1c329cca82e331d3dd

  • SHA256

    450fe551f9989c51ae6b8ad556b22c4f34076f1cc61d2ffdfab5c55522d6e210

  • SHA512

    5c6e72643f33898134195f5a8b19c9f56066d2e8f16f9032b8bd54dba185b33b5dc877d14e941c59bba2b312fe95931c875cb8f39fd20dfd2ef9a4d9d690882f

Score
10/10
smokeloaderbackdoorpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://hydroxychl0roquine.xyz/

https://hydroxychl0roquine.xyz/
rc4.i32
rc4.i32

Targets

    • Target

      450fe551f9989c51ae6b8ad556b22c4f34076f1cc61d2ffdfab5c55522d6e210

    • Size

      231KB

    • MD5

      f37caf1332fe729273767e8839d95abc

    • SHA1

      485fc320582b7c2ce5f9ec1c329cca82e331d3dd

    • SHA256

      450fe551f9989c51ae6b8ad556b22c4f34076f1cc61d2ffdfab5c55522d6e210

    • SHA512

      5c6e72643f33898134195f5a8b19c9f56066d2e8f16f9032b8bd54dba185b33b5dc877d14e941c59bba2b312fe95931c875cb8f39fd20dfd2ef9a4d9d690882f

    Score
    10/10
    smokeloaderbackdoorpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks