Overview

overview

10

Static

static

88762c86f1...87.exe

windows7-x64

10

88762c86f1...87.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    88762c86f125cc73e5340bf6beb1c887.exe

  • Size

    141KB

  • Sample

    221103-ll2pfsbbdq

  • MD5

    88762c86f125cc73e5340bf6beb1c887

  • SHA1

    6f77cc18c2da464b12a9fae8077f4c1bfc97c217

  • SHA256

    1fae0b98796b9393c5dd5345c7f955514feb8ac99b5a3d1fb76021bb1fd5f820

  • SHA512

    cdeaf5e6e01cbabc5c62e3e22e47276c75acdfb2faf1590f5b51516e071970f883e459667ce5f844af5aa3cc6cd729767a7b61377dafebf5c542ad273e2a522b

  • SSDEEP

    3072:FrV6ZGjXpoGoByXPQs2UTXQ8yb7aFcIiSIvF68xJ2k8Y:FwZGbpYByPT7lyvIcRSIvF68x98

Score
10/10
smokeloaderbackdoorcollectionpersistencetrojan

Malware Config

Targets

    • Target

      88762c86f125cc73e5340bf6beb1c887.exe

    • Size

      141KB

    • MD5

      88762c86f125cc73e5340bf6beb1c887

    • SHA1

      6f77cc18c2da464b12a9fae8077f4c1bfc97c217

    • SHA256

      1fae0b98796b9393c5dd5345c7f955514feb8ac99b5a3d1fb76021bb1fd5f820

    • SHA512

      cdeaf5e6e01cbabc5c62e3e22e47276c75acdfb2faf1590f5b51516e071970f883e459667ce5f844af5aa3cc6cd729767a7b61377dafebf5c542ad273e2a522b

    • SSDEEP

      3072:FrV6ZGjXpoGoByXPQs2UTXQ8yb7aFcIiSIvF68xJ2k8Y:FwZGbpYByPT7lyvIcRSIvF68x98

    Score
    10/10
    smokeloaderbackdoorpersistencetrojancollection

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks