Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    278KB

  • Sample

    230109-larp4sdf74

  • MD5

    6ea210bfd858868cd3d16e3c0e5284d4

  • SHA1

    1ed4eab42076ddbd524b701ab345b882a5c19eea

  • SHA256

    189b68dca1a8e4d0ec372e03b3442d09aff6b73928155ec9d4546ef6006427c3

  • SHA512

    961fd229491703fa0fb0619815b7ce80341ffa17b3994a272124d1ed85617c2b68c6de133c9827143bdc6c46db608f32479946ede83329923182dd8a389e6c3d

  • SSDEEP

    3072:7XOWy2p2EapL3dMel5cDX2mgJN4/R2nEYSSMSACdmEF2xU9Q/Wl:Tzp2E4LNF0U4ZK3dzF2xU9y

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      278KB

    • MD5

      6ea210bfd858868cd3d16e3c0e5284d4

    • SHA1

      1ed4eab42076ddbd524b701ab345b882a5c19eea

    • SHA256

      189b68dca1a8e4d0ec372e03b3442d09aff6b73928155ec9d4546ef6006427c3

    • SHA512

      961fd229491703fa0fb0619815b7ce80341ffa17b3994a272124d1ed85617c2b68c6de133c9827143bdc6c46db608f32479946ede83329923182dd8a389e6c3d

    • SSDEEP

      3072:7XOWy2p2EapL3dMel5cDX2mgJN4/R2nEYSSMSACdmEF2xU9Q/Wl:Tzp2E4LNF0U4ZK3dzF2xU9y

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks