Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    223KB

  • Sample

    221225-fqvttaec6s

  • MD5

    48c2031b82e27f60b5c07b84ab3ccfe5

  • SHA1

    d7ac785078d95d63b221e508bdc22e41dfb709cd

  • SHA256

    932ba1468220264f7f2991e8ca915a6ba3c2bc9a37b747a16c50d983fe89c5d2

  • SHA512

    3058f2bb1f77bae27717b581ec5e81e474f0ef21ac6980ac4c8061a69883f1aa9c09e7a52bb8dbeb066ad666fb381fd2864e00e9a6f331bbf95e3907bf0c57df

  • SSDEEP

    3072:ZDn7pjqKLTU5sSc3/pHfO3fdomGiHs02GauDrkf/ln:LjqKLTtScPp/YfdomGzGaMq

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      223KB

    • MD5

      48c2031b82e27f60b5c07b84ab3ccfe5

    • SHA1

      d7ac785078d95d63b221e508bdc22e41dfb709cd

    • SHA256

      932ba1468220264f7f2991e8ca915a6ba3c2bc9a37b747a16c50d983fe89c5d2

    • SHA512

      3058f2bb1f77bae27717b581ec5e81e474f0ef21ac6980ac4c8061a69883f1aa9c09e7a52bb8dbeb066ad666fb381fd2864e00e9a6f331bbf95e3907bf0c57df

    • SSDEEP

      3072:ZDn7pjqKLTU5sSc3/pHfO3fdomGiHs02GauDrkf/ln:LjqKLTtScPp/YfdomGzGaMq

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks