General
-
Target
2de9e6cf1e4ffe221396616f90adc68f7637482ad14a01f4721f19fbaa91daf7
-
Size
224KB
-
Sample
220622-qdvy6ahhb6
-
MD5
60c7754a9d132499c833dae8cfa43dcb
-
SHA1
07559e36e207efc021678607c9382cfb90689e18
-
SHA256
2de9e6cf1e4ffe221396616f90adc68f7637482ad14a01f4721f19fbaa91daf7
-
SHA512
aa10834e281f429d23ea69c93a2a80231726025e75fb6544bd50dd86879b81d418abafa99fe76c994b93f3c3ca1c1f76a85654fed86f59db4190991da87dd9da
Static task
static1
Behavioral task
behavioral1
Sample
2de9e6cf1e4ffe221396616f90adc68f7637482ad14a01f4721f19fbaa91daf7.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2de9e6cf1e4ffe221396616f90adc68f7637482ad14a01f4721f19fbaa91daf7.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
smokeloader
2017
http://derevo.bit/1/
http://ds12.ng/1/
Targets
-
-
Target
2de9e6cf1e4ffe221396616f90adc68f7637482ad14a01f4721f19fbaa91daf7
-
Size
224KB
-
MD5
60c7754a9d132499c833dae8cfa43dcb
-
SHA1
07559e36e207efc021678607c9382cfb90689e18
-
SHA256
2de9e6cf1e4ffe221396616f90adc68f7637482ad14a01f4721f19fbaa91daf7
-
SHA512
aa10834e281f429d23ea69c93a2a80231726025e75fb6544bd50dd86879b81d418abafa99fe76c994b93f3c3ca1c1f76a85654fed86f59db4190991da87dd9da
Score10/10-
suricata: ET MALWARE Possible Sharik/Smoke Loader Microsoft Connectivity check M3
suricata: ET MALWARE Possible Sharik/Smoke Loader Microsoft Connectivity check M3
-
suricata: ET MALWARE Sharik/Smoke Loader Microsoft Connectivity Check
suricata: ET MALWARE Sharik/Smoke Loader Microsoft Connectivity Check
-
Adds policy Run key to start application
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-