Description
Modular backdoor trojan in use since 2014.
e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a
General
Target
Size
Sample
e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a
305KB
220521-sky1hadbak
Score
10 /10
MD5
SHA1
SHA256
SHA512
62e9a0a9002954fc9b9b7f3eb6961cea
18a360987b4df973d3b5090582bdd03e0ff5cffd
e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a
750791e2c3c91df5ae3ad946571e232d810ed22bc83303a625a422c230285e9bdd0c5577623b4dc02bb91790769f59abdb5858bc97ad496773a594f49e66ccf3
Malware Config
Extracted
| Family | smokeloader |
| Version | 2020 |
| C2 |
https://ny-city-mall.com/search.php https://fresh-cars.net/search.php |
| rc4.i32 |
|
| rc4.i32 |
|
Targets
Target
MD5
Filesize
e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a
62e9a0a9002954fc9b9b7f3eb6961cea
305KB
Score
10/10
SHA1
SHA256
SHA512
18a360987b4df973d3b5090582bdd03e0ff5cffd
e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a
750791e2c3c91df5ae3ad946571e232d810ed22bc83303a625a422c230285e9bdd0c5577623b4dc02bb91790769f59abdb5858bc97ad496773a594f49e66ccf3
Tags
Signatures
-
SmokeLoader
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
Description
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
Tags
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
Description
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
Tags
-
Modifies Windows Firewall
Tags
TTPs
-
Deletes itself
-
Accesses Microsoft Outlook profiles
Tags
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks