Overview

overview

10

Static

static

1

6283f146de...df.exe

windows7-x64

10

6283f146de...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6283f146de9efc701fe73cb8e70dcfdf.exe

  • Size

    229KB

  • Sample

    230219-vhzkcsga97

  • MD5

    6283f146de9efc701fe73cb8e70dcfdf

  • SHA1

    54fa717982798b63c01b253d37bc3d3a71806a76

  • SHA256

    f2f4ea45f2fc943f867edcff5f7395d9565d951310d74f050c2decbd0ef3a8e0

  • SHA512

    0ad4c90c2f34e402e952a90eeeeb4b86e262d3472ecb20698eb3d1484b2a21d204ea9ac81c76a6075e3ee0f0572fd52d1aa92cbb83a7defb95ec4cf6a880c84a

  • SSDEEP

    3072:jd9hv6kLh1Ph2mH2ERlxXLeoCsLamLd7k/rc+nMCCVNbV8KukZH8oCEfMRI:Rv6kLx2gRlhzbL5hArc+nUNOKukilEs

Score
10/10
pandastealersmokeloaderbackdoorstealertrojan

Malware Config

Targets

    • Target

      6283f146de9efc701fe73cb8e70dcfdf.exe

    • Size

      229KB

    • MD5

      6283f146de9efc701fe73cb8e70dcfdf

    • SHA1

      54fa717982798b63c01b253d37bc3d3a71806a76

    • SHA256

      f2f4ea45f2fc943f867edcff5f7395d9565d951310d74f050c2decbd0ef3a8e0

    • SHA512

      0ad4c90c2f34e402e952a90eeeeb4b86e262d3472ecb20698eb3d1484b2a21d204ea9ac81c76a6075e3ee0f0572fd52d1aa92cbb83a7defb95ec4cf6a880c84a

    • SSDEEP

      3072:jd9hv6kLh1Ph2mH2ERlxXLeoCsLamLd7k/rc+nMCCVNbV8KukZH8oCEfMRI:Rv6kLx2gRlhzbL5hArc+nUNOKukilEs

    Score
    10/10
    smokeloaderbackdoortrojanpandastealerstealer

    • Detects Smokeloader packer

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks