Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    195KB

  • Sample

    230203-g4ycjafb8x

  • MD5

    56100628ee1fd29a772db64eed2abc96

  • SHA1

    57a0687e2cdbd11e503bdb08069a271d5ff47647

  • SHA256

    084c0aa92e9a0cc7c14f9bf1215cc72f56aabb22d8ec7283abf77d4be03c7c98

  • SHA512

    4852cbca0b713af5cd73b11234179f2f0543037b479346a7c26a18842b51e50cb7acc71451ae7dee292946841c09cf9ecf520a145601727825a139aaacd37e77

  • SSDEEP

    3072:BHlXwFpRDUWLx83cWS258ofxhi0EfKXMHDSSyefBISTXHUUngGw:BHl6lLx83cHjsEfBH9ZISTX02hw

Score
10/10
smokeloaderbackdoorpersistencetrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      195KB

    • MD5

      56100628ee1fd29a772db64eed2abc96

    • SHA1

      57a0687e2cdbd11e503bdb08069a271d5ff47647

    • SHA256

      084c0aa92e9a0cc7c14f9bf1215cc72f56aabb22d8ec7283abf77d4be03c7c98

    • SHA512

      4852cbca0b713af5cd73b11234179f2f0543037b479346a7c26a18842b51e50cb7acc71451ae7dee292946841c09cf9ecf520a145601727825a139aaacd37e77

    • SSDEEP

      3072:BHlXwFpRDUWLx83cWS258ofxhi0EfKXMHDSSyefBISTXHUUngGw:BHl6lLx83cHjsEfBH9ZISTX02hw

    Score
    10/10
    smokeloaderbackdoortrojanpersistence

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks