Overview

overview

10

Static

static

df9a0a3860...0f.exe

windows7-x64

10

df9a0a3860...0f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df9a0a38602b7e9dfee0bc5a7847e90f.exe

  • Size

    144KB

  • Sample

    221128-jgz9qabf9w

  • MD5

    df9a0a38602b7e9dfee0bc5a7847e90f

  • SHA1

    ea5ca4778ecb8cb6131e10e6cac5b946119a828d

  • SHA256

    a729b1edad51cceeac9a61f69e17f984d48983a9ca72a4bef36a6f48bae3611b

  • SHA512

    d7bc74782ba786d284f5cd3014858892af0a855306cae538decb76a65b07c73d9f1ee0e87b517cc7ac25023215da056e8c08adfec1fbdda85a9bf450653dae11

  • SSDEEP

    3072:BoLX8lHRJZehA+5EddbAPcpP+kimiyiduNeF5Q4Yn:WXibZeh47iC3TXiduN+52

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      df9a0a38602b7e9dfee0bc5a7847e90f.exe

    • Size

      144KB

    • MD5

      df9a0a38602b7e9dfee0bc5a7847e90f

    • SHA1

      ea5ca4778ecb8cb6131e10e6cac5b946119a828d

    • SHA256

      a729b1edad51cceeac9a61f69e17f984d48983a9ca72a4bef36a6f48bae3611b

    • SHA512

      d7bc74782ba786d284f5cd3014858892af0a855306cae538decb76a65b07c73d9f1ee0e87b517cc7ac25023215da056e8c08adfec1fbdda85a9bf450653dae11

    • SSDEEP

      3072:BoLX8lHRJZehA+5EddbAPcpP+kimiyiduNeF5Q4Yn:WXibZeh47iC3TXiduN+52

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks