smokeloader | 1397af025217d33a3af3debc6d6fe621ca0d9f2e6797abde411f58e752f054b6 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

0b1780772e...e4.exe

windows7-x64

0b1780772e...e4.exe

windows10-2004-x64

Sharing

General

Target

0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4.zip
Size

185KB
Sample

230516-wlr55abh75
MD5

de5b534d0e0fe4c9ad644b4f3930e0e5
SHA1

f68d234c8a30396c2895087d3732b3083fb66093
SHA256

1397af025217d33a3af3debc6d6fe621ca0d9f2e6797abde411f58e752f054b6
SHA512

c34416109048767318bc3d946b418cb58388edb0a883634866c4663c730cd5dc5998487b4ca9f81fcfdfaaa58722f0092dd8858c7a665d9d4dae3d7f82802f93
SSDEEP

3072:J5ULM4KqRdrCTUO1n+Ki+/hBAYdY++LpF6GRf5RXlTiz67vghstOfX7dX5mAfg:fZx22TR1n/fjvSXyDhs0fX7jffg

Score

10^/10

smokeloader sprg backdoor discovery spyware stealer trojan vmprotect

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4.exe

Resource

win7-20230220-en

smokeloader sprg backdoor trojan

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4.exe

Resource

win10v2004-20230220-en

smokeloader sprg backdoor discovery spyware stealer trojan vmprotect

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

1
0x090cd984

rc4.i32

1
0x0d8ab546

Targets

- Target
  
  0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4.exe
- Size
  
  313KB
- MD5
  
  4db73a32cecfa765907e892b7aea8345
- SHA1
  
  c420d45d39f21d01bfc71eafd0750fe3cc256a63
- SHA256
  
  0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4
- SHA512
  
  0007ffba3eb76a2240da84b5b8138d939dd512a6ffb59f83dfce730c5dcf06635b408c5b20bfbd99d254530e0f8bd5deb6f60b4ef49e1b5b6f558e2d3f9fd9a1
- SSDEEP
  
  3072:iAXPGgaSaDNJOanCLg3Tcjke0m4gyRAY0+qryYIu+PKPSvNO644vKSgI5gPc3Pgc:3+Sa5MfLgjcwTYyRAYBqryXq4SZOc
Score

10^/10

smokeloader sprg backdoor trojan discovery spyware stealer vmprotect
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloadersprgbackdoortrojan

behavioral2

smokeloadersprgbackdoordiscoveryspywarestealertrojanvmprotect

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.