Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    267KB

  • Sample

    230112-ll2pfsbd7y

  • MD5

    45a7055e317f48800fc807f5fd4825d9

  • SHA1

    20df0a269eff099458db24c3f6bb91f666bde7a8

  • SHA256

    3e8e9d2df4abc9f900477b39e1fc6a107b1371d7502c60b0cac2beb56b76ee0d

  • SHA512

    1c560f72c4028ffcc33a529da9f897001ac820bd3afb92c543f6afcdbbc13b86f80fa5b74c7040a8c08e6b48f90d0dd4db89996813b1aa553e6a74352713ad65

  • SSDEEP

    3072:t4vXE8AJV4LT4w/H+b7N5KNp//05LDBH5i0FlEuCJnVmJWZe9t3cSlfPx76b5qWZ:tWCiLt+b7o01BHQMl/CSWyZ5gq+

Score
10/10
smokeloaderbackdoordiscoverytrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      267KB

    • MD5

      45a7055e317f48800fc807f5fd4825d9

    • SHA1

      20df0a269eff099458db24c3f6bb91f666bde7a8

    • SHA256

      3e8e9d2df4abc9f900477b39e1fc6a107b1371d7502c60b0cac2beb56b76ee0d

    • SHA512

      1c560f72c4028ffcc33a529da9f897001ac820bd3afb92c543f6afcdbbc13b86f80fa5b74c7040a8c08e6b48f90d0dd4db89996813b1aa553e6a74352713ad65

    • SSDEEP

      3072:t4vXE8AJV4LT4w/H+b7N5KNp//05LDBH5i0FlEuCJnVmJWZe9t3cSlfPx76b5qWZ:tWCiLt+b7o01BHQMl/CSWyZ5gq+

    Score
    10/10
    smokeloaderbackdoortrojandiscovery

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks