Overview

overview

10

Static

static

f1b1349d6b...0c.exe

windows7-x64

10

f1b1349d6b...0c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1b1349d6b032e77485d468213f9e86e324d82769ea3638ae3761e536462640c.exe

  • Size

    351KB

  • Sample

    221204-v13dzaaf76

  • MD5

    eb496a5c11501b5f26b7e9a1c724e5ee

  • SHA1

    544d09d8c1e1bf3ed001470bbaf3962bd549c63b

  • SHA256

    f1b1349d6b032e77485d468213f9e86e324d82769ea3638ae3761e536462640c

  • SHA512

    3b0d97f0803fcb964cb14906c6321ea4bb974b4ee515ce66cd914a85a2f57c2f8f75383939a373830c3af14e8618274992091101e006c1b826570db700652013

  • SSDEEP

    6144:X47/Aje4pwcV1fVhX+/xbJnMW2RqnZT5Y:X4jAjxHYxbtMW3ZT5Y

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      f1b1349d6b032e77485d468213f9e86e324d82769ea3638ae3761e536462640c.exe

    • Size

      351KB

    • MD5

      eb496a5c11501b5f26b7e9a1c724e5ee

    • SHA1

      544d09d8c1e1bf3ed001470bbaf3962bd549c63b

    • SHA256

      f1b1349d6b032e77485d468213f9e86e324d82769ea3638ae3761e536462640c

    • SHA512

      3b0d97f0803fcb964cb14906c6321ea4bb974b4ee515ce66cd914a85a2f57c2f8f75383939a373830c3af14e8618274992091101e006c1b826570db700652013

    • SSDEEP

      6144:X47/Aje4pwcV1fVhX+/xbJnMW2RqnZT5Y:X4jAjxHYxbtMW3ZT5Y

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks