Overview

overview

10

Static

static

255cb851c6...56.exe

windows7_x64

10

255cb851c6...56.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    255cb851c6efc840d6c95de7e2ee53b6a0a77356d4d5f05488851ee02ccae256

  • Size

    172KB

  • Sample

    220611-x1s7eadahp

  • MD5

    436b9ec31453c1d792f7553532f29918

  • SHA1

    26e0e2e21bbeb409335d3dfab4e77739a70fc1ca

  • SHA256

    255cb851c6efc840d6c95de7e2ee53b6a0a77356d4d5f05488851ee02ccae256

  • SHA512

    4b7cf88c970e111dd439396109f6a4ef0f074bd4453ab05a71b1a958f08870c0960cda6b06b7c56a8586b5ab75623f0c543837f5cad9c2f455eb37edc8e2d2c1

Score
10/10
smokeloaderbackdoorpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://xcols.bit/1/

http://siled.bit/1/

http://ds12.ng/1/

http://d3s1.me/1/

Targets

    • Target

      255cb851c6efc840d6c95de7e2ee53b6a0a77356d4d5f05488851ee02ccae256

    • Size

      172KB

    • MD5

      436b9ec31453c1d792f7553532f29918

    • SHA1

      26e0e2e21bbeb409335d3dfab4e77739a70fc1ca

    • SHA256

      255cb851c6efc840d6c95de7e2ee53b6a0a77356d4d5f05488851ee02ccae256

    • SHA512

      4b7cf88c970e111dd439396109f6a4ef0f074bd4453ab05a71b1a958f08870c0960cda6b06b7c56a8586b5ab75623f0c543837f5cad9c2f455eb37edc8e2d2c1

    Score
    10/10
    smokeloaderbackdoortrojanpersistence

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks