Overview

overview

10

Static

static

29bd4ef84c...24.exe

windows7_x64

10

29bd4ef84c...24.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724

  • Size

    180KB

  • Sample

    220615-qlvncsbbf7

  • MD5

    33853c2fe24684a7211293ccc4747bf1

  • SHA1

    6ef73fd47628c650ea4c028e833c4fb399ceab67

  • SHA256

    29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724

  • SHA512

    7f9060902747dcc6e3eb2e7e9bbae3146ec8c9228aeff16a47a07ad1e2c749d50143d289a81755a17dba8f561b718ec6b188df55e11c5f4582e48b94a1eb9ac5

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://jo15y.xyz/br/

rc4.i32
rc4.i32

Targets

    • Target

      29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724

    • Size

      180KB

    • MD5

      33853c2fe24684a7211293ccc4747bf1

    • SHA1

      6ef73fd47628c650ea4c028e833c4fb399ceab67

    • SHA256

      29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724

    • SHA512

      7f9060902747dcc6e3eb2e7e9bbae3146ec8c9228aeff16a47a07ad1e2c749d50143d289a81755a17dba8f561b718ec6b188df55e11c5f4582e48b94a1eb9ac5

    Score
    10/10
    smokeloaderbackdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks