smokeloader | 1d8d0c9e0eefc5304195e062651bab35aaa1bccd4820d03c54793fea2e3e7ec2 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

1d8d0c9e0eefc5304195e062651bab35aaa1bccd4820d03c54793fea2e3e7ec2
Size

229KB
Sample

221019-x2hr3adfh2
MD5

94f42eccc9fb39a28858b35c8cb24b08
SHA1

8d66c6fcf38d634fa6ec5ebf7d21071cfdc5b1c4
SHA256

1d8d0c9e0eefc5304195e062651bab35aaa1bccd4820d03c54793fea2e3e7ec2
SHA512

01c4526e9107bae1cd88dfb891151dd7305a276e5af15ff439eb4432690173713ffa1eb38c4598de7338c531acce6a849afa8eb150bdd2ac6e75e336621c7a95
SSDEEP

3072:m625jqCVBpZuEafLGQfFWLzIxgeU2qo/nKxhPHB/eUF5NGKU3nFzG:m6wGd/LnfFGzEpKxpB/egE93n

Score

10^/10

smokeloader backdoor discovery spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

1d8d0c9e0eefc5304195e062651bab35aaa1bccd4820d03c54793fea2e3e7ec2.exe

Resource

win10v2004-20220812-en

smokeloader backdoor discovery spyware stealer trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  1d8d0c9e0eefc5304195e062651bab35aaa1bccd4820d03c54793fea2e3e7ec2
- Size
  
  229KB
- MD5
  
  94f42eccc9fb39a28858b35c8cb24b08
- SHA1
  
  8d66c6fcf38d634fa6ec5ebf7d21071cfdc5b1c4
- SHA256
  
  1d8d0c9e0eefc5304195e062651bab35aaa1bccd4820d03c54793fea2e3e7ec2
- SHA512
  
  01c4526e9107bae1cd88dfb891151dd7305a276e5af15ff439eb4432690173713ffa1eb38c4598de7338c531acce6a849afa8eb150bdd2ac6e75e336621c7a95
- SSDEEP
  
  3072:m625jqCVBpZuEafLGQfFWLzIxgeU2qo/nKxhPHB/eUF5NGKU3nFzG:m6wGd/LnfFGzEpKxpB/egE93n
Score

10^/10

smokeloader backdoor discovery spyware stealer trojan
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoveryspywarestealertrojan

© 2018-2025

Terms | Privacy