smokeloader

General

Target

fab5f16b7b7f88aad46914ea2a932c11e376d2c44da5cd33bc16ecb393f084c3.exe
Size

8.7MB
Sample

220521-yh4e4adbc6
MD5

a9aea2720aa1e020bf30e7f17463bf2d
SHA1

2bb5d89679bc041680932db0757e1a53f2db37e5
SHA256

fab5f16b7b7f88aad46914ea2a932c11e376d2c44da5cd33bc16ecb393f084c3
SHA512

6a7fb096ccd9d910ad940f18446213a52983c0f625edf055cacd0d7552b393deffa400c37941a564866174c73b2b7738451772b7a769a7a6b7f947415424954d

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

http://bahninfo.at/upload/

http://img4mobi.com/upload/

http://equix.ru/upload/

http://worldalltv.com/upload/

http://negarehgallery.com/upload/

http://lite-server.ru/upload/

http://piratia/su/upload/

http://go-piratia.ru/upload/

rc4.i32

Targets

- Target
  
  fab5f16b7b7f88aad46914ea2a932c11e376d2c44da5cd33bc16ecb393f084c3.exe
- Size
  
  8.7MB
- MD5
  
  a9aea2720aa1e020bf30e7f17463bf2d
- SHA1
  
  2bb5d89679bc041680932db0757e1a53f2db37e5
- SHA256
  
  fab5f16b7b7f88aad46914ea2a932c11e376d2c44da5cd33bc16ecb393f084c3
- SHA512
  
  6a7fb096ccd9d910ad940f18446213a52983c0f625edf055cacd0d7552b393deffa400c37941a564866174c73b2b7738451772b7a769a7a6b7f947415424954d
Score

10^/10

smokeloader backdoor discovery evasion spyware stealer trojan vmprotect
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2