Overview

overview

10

Static

static

715913ccfa...30.exe

windows7-x64

10

715913ccfa...30.exe

windows10-2004-x64

10

Resubmissions

04/01/2023, 23:55

230104-3ymjqsaa85 10

04/01/2023, 23:03

230104-21mrvadd8v 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    715913ccfa78aae131126d5b2bfb80c74130a8273882064b6c7b5037a723a030

  • Size

    365KB

  • Sample

    230104-3ymjqsaa85

  • MD5

    596d21bbe19d67ea9056ca1d63752fb3

  • SHA1

    431220aa4cde4cbaa161506e39b4835f3b3ae52e

  • SHA256

    715913ccfa78aae131126d5b2bfb80c74130a8273882064b6c7b5037a723a030

  • SHA512

    4dd9a2f386369779fef9bf38665bab113a4761b862c102c894f6d8605895a270f6c6048568524029e6910a153dd3cf4d1db09b91c5d2ae1698e2f382001fd3fa

  • SSDEEP

    3072:y6XMnvHLCVR14P5pPSs/djFiUq8diov2bdZF4F0zf8jdA4upFldiLLkGH/lPiXY9:9MfLCV4bndFiUqQepPfoxupmLz/jTl

Score
10/10
smokeloaderbackdoorspywarestealertrojan

Malware Config

Targets

    • Target

      715913ccfa78aae131126d5b2bfb80c74130a8273882064b6c7b5037a723a030

    • Size

      365KB

    • MD5

      596d21bbe19d67ea9056ca1d63752fb3

    • SHA1

      431220aa4cde4cbaa161506e39b4835f3b3ae52e

    • SHA256

      715913ccfa78aae131126d5b2bfb80c74130a8273882064b6c7b5037a723a030

    • SHA512

      4dd9a2f386369779fef9bf38665bab113a4761b862c102c894f6d8605895a270f6c6048568524029e6910a153dd3cf4d1db09b91c5d2ae1698e2f382001fd3fa

    • SSDEEP

      3072:y6XMnvHLCVR14P5pPSs/djFiUq8diov2bdZF4F0zf8jdA4upFldiLLkGH/lPiXY9:9MfLCV4bndFiUqQepPfoxupmLz/jTl

    Score
    10/10
    smokeloaderbackdoortrojanspywarestealer

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks