Overview

overview

10

Static

static

1339d8437b...53.exe

windows7-x64

10

1339d8437b...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1339d8437b13ceca77e24912f9c3fe11e30b32f71bc7da03c4f86a4c8a218453.zip

  • Size

    111KB

  • Sample

    221121-m2ltlsff37

  • MD5

    9767a3bddbccfa31b1cd86da1de883f2

  • SHA1

    5a0d8b75ca0b9817a6181ca9380ec8c80f719922

  • SHA256

    b979759d2943254bd29d04aec2c0d7ce655b28101a303d961e96fcd6efe3a600

  • SHA512

    72d4ac094296ff4fbf5a0434c685a7779beea5636c5a01a24791c986677009a3dd34b2adde76bf3e33e68b1c83795d5b3fa900accfa18e15cd64a56b480e8461

  • SSDEEP

    3072:89NmVWJjMOJ6QncTa1NoM91JdkEdcRMdVXfPtK8XRswHlQOqx5FO:8OVPod+0NoMDnNVd1PY8XOwHCOQs

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      1339d8437b13ceca77e24912f9c3fe11e30b32f71bc7da03c4f86a4c8a218453.exe

    • Size

      163KB

    • MD5

      b4d551e1ae248fd9bbf157e5c8b9a1a9

    • SHA1

      adf99319734136d0c619dcbb089fa4d4743ae239

    • SHA256

      1339d8437b13ceca77e24912f9c3fe11e30b32f71bc7da03c4f86a4c8a218453

    • SHA512

      584fca9677747ccde53d82faca59938a5f353671eca9248f711e93b29852b8aa952ae6fc055107a4a1fc2c9e95bfa1f8adb1d4b38888c2a3bc09e29e189c741e

    • SSDEEP

      3072:Eakj1CJOHiPNYH5vuncNz5X2LMTXMmg8cmoxJ/1T:ERCe4Npyz5X2LpmgvmoJ/

    Score
    10/10
    smokeloaderbackdoortrojancollectiondiscoveryspywarestealer

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks