General
-
Target
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9
-
Size
240KB
-
Sample
220708-gs5x8scear
-
MD5
491bf48093ce883bc2caf2e7d37f91a5
-
SHA1
388f82016f77a1809e73162c447d1d3d34288b29
-
SHA256
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9
-
SHA512
223cb619a9598ffd1f33197bd25c8208a3792a46b7062945ec320e2f499fe86a40f17720b8140cfc936f2b0b1d58620bb31dba1b0fa25935cb65e404ae90c7c0
Static task
static1
Behavioral task
behavioral1
Sample
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
smokeloader
2017
http://derevo.bit/1/
http://ds12.ng/1/
Targets
-
-
Target
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9
-
Size
240KB
-
MD5
491bf48093ce883bc2caf2e7d37f91a5
-
SHA1
388f82016f77a1809e73162c447d1d3d34288b29
-
SHA256
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9
-
SHA512
223cb619a9598ffd1f33197bd25c8208a3792a46b7062945ec320e2f499fe86a40f17720b8140cfc936f2b0b1d58620bb31dba1b0fa25935cb65e404ae90c7c0
Score10/10-
suricata: ET MALWARE Possible Sharik/Smoke Loader Microsoft Connectivity check M3
suricata: ET MALWARE Possible Sharik/Smoke Loader Microsoft Connectivity check M3
-
suricata: ET MALWARE Sharik/Smoke Loader Java Connectivity Check
suricata: ET MALWARE Sharik/Smoke Loader Java Connectivity Check
-
suricata: ET MALWARE Sharik/Smoke Loader Microsoft Connectivity Check
suricata: ET MALWARE Sharik/Smoke Loader Microsoft Connectivity Check
-
Adds policy Run key to start application
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-