Overview

overview

10

Static

static

1de8e1b084...1b.exe

windows7-x64

10

1de8e1b084...1b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1de8e1b084c93bad8b50ad7d602f88faad784b39f1ca9fe560e5aa854e1ded1b

  • Size

    104KB

  • Sample

    221129-3lv1cace51

  • MD5

    17dd9b56998b769f440f40109e6e1733

  • SHA1

    5a4ae3a08c6b60841246acd318e7aaa282cabad7

  • SHA256

    e89243358ee7797bbcb3c1123cae83694a0001c0c31ac167ca4184b109ab585c

  • SHA512

    c71d4cfe2a8a3cd47246d64a4c6cba8adef778d2f31d41473ef3a27296ce93ac6170fd359316ccbc2131abb63982ac35248867dc879e0778c8563c77343d61fb

  • SSDEEP

    3072:/KrxpMsANfzVXj2Co6shaXIPA6PKc++U+bR:sLNANhMh1Qc++U+bR

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      1de8e1b084c93bad8b50ad7d602f88faad784b39f1ca9fe560e5aa854e1ded1b

    • Size

      146KB

    • MD5

      d490f9bab631ea50242b564626754c83

    • SHA1

      4f323782df0579b664d18f421ce6421760ecea4c

    • SHA256

      1de8e1b084c93bad8b50ad7d602f88faad784b39f1ca9fe560e5aa854e1ded1b

    • SHA512

      8664f5742fc699cf9d8fd582f52e0231a0fd0331e0306e651bb344a787b31c5fb69221a4d12fb680b420147d4808bbb17e4b3d3407edfe9190c220d55b0afd3b

    • SSDEEP

      1536:/4lmrSzydnJr1tXFFufn8rP21Kh5Np5wOkEBLdgH6hHGvjfWLq2bUWlIKdWPRFYu:QlGXWUCIfv5hVLKvyOGRlIKkPRFYdw

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks