Overview

overview

10

Static

static

05e29acaed...90.exe

windows7-x64

10

05e29acaed...90.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    05e29acaed866ce861227e4e0a287890.exe

  • Size

    316KB

  • Sample

    230202-pdq5jaab4t

  • MD5

    05e29acaed866ce861227e4e0a287890

  • SHA1

    87558dd11c4cd704566877cb2fb8e0f1fb71d59a

  • SHA256

    b2e449dd5938e3461527526ba950af67894c6c3a3b01f79aa2a0d38cc64327b0

  • SHA512

    9e917589bd05c8e6f45d50f947b522bad0327d076140c38432de8fb912ff1922d1be1130b97d3fb65a03b018488856cd1e3db046c4837fc1aa65ad51ee329372

  • SSDEEP

    6144:4wL7M7b9k5actb6E9mpC2x8zw6EG6L9/CJTk637eQfnd5wYoB:p+bS5act0OzgG6L9CJb7d5wY

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      05e29acaed866ce861227e4e0a287890.exe

    • Size

      316KB

    • MD5

      05e29acaed866ce861227e4e0a287890

    • SHA1

      87558dd11c4cd704566877cb2fb8e0f1fb71d59a

    • SHA256

      b2e449dd5938e3461527526ba950af67894c6c3a3b01f79aa2a0d38cc64327b0

    • SHA512

      9e917589bd05c8e6f45d50f947b522bad0327d076140c38432de8fb912ff1922d1be1130b97d3fb65a03b018488856cd1e3db046c4837fc1aa65ad51ee329372

    • SSDEEP

      6144:4wL7M7b9k5actb6E9mpC2x8zw6EG6L9/CJTk637eQfnd5wYoB:p+bS5act0OzgG6L9CJb7d5wY

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks