Overview

overview

10

Static

static

623e70a754...12.exe

windows7-x64

10

623e70a754...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    623e70a754f70078d4dc9a4dd2b463bf7aba3dc1cd298ae5655a6e2662c5ff12

  • Size

    105KB

  • Sample

    221129-zc7q1aha6w

  • MD5

    11b10ba7fae91c2e2dac2824a1dfa8c1

  • SHA1

    27760dcbcead284ba6d1b8a26f175e69a8bfbada

  • SHA256

    ba3bb6cf6c072ff00837c58aef1e55f7f0632f0d0fbe59270726b3d4cf151c14

  • SHA512

    d3ad54d3cfa1ef628105cdda389d7c700458ae4b7595809bc7d8c653df629d268669a50c33e1df6f3cc3c03e2aa7c4f650909cfe4e26eb0e5859f5be53c9967a

  • SSDEEP

    3072:e2KB3ditn/Gma46iZjHzbFZLFRA3buJr3IVgw:eHB3dQFaOxvFZLFREG7iZ

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      623e70a754f70078d4dc9a4dd2b463bf7aba3dc1cd298ae5655a6e2662c5ff12

    • Size

      147KB

    • MD5

      4ae6a1b48b247e96a4ce2c45f47a83af

    • SHA1

      1367995fd09eb6c0b6025dd78297e8b4361fdebe

    • SHA256

      623e70a754f70078d4dc9a4dd2b463bf7aba3dc1cd298ae5655a6e2662c5ff12

    • SHA512

      8291a88e977377daf593d0d09d1fecd59d76d4304a9edf771d7d76be50b16a2b2693dc38e499bc0ed3661b0cae9ad2c90cdf9e5d3c5bf5bc2f0c11ad4899b0da

    • SSDEEP

      1536:0JGpRCeYkhzVXB5Fdun6kP9igln5IohNbxYI2zuaRtdscK0pnyvls8huIXf+nY1u:ppI8Rprun5VYvua/6Uy+8DnptELz

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks