smokeloader | f2530f27a0d43cf227cdc9389192d5c3296abca41dccd3ccd8f39939b68bb9b7 | Triage

Sharing

General

Target

f2530f27a0d43cf227cdc9389192d5c3296abca41dccd3ccd8f39939b68bb9b7
Size

162KB
Sample

240417-qe8xeagg72
MD5

aebf952920c0baf1cbb29e6151f947a6
SHA1

1f3bbb46c28bab35f610953336c1b11b75a3fe29
SHA256

f2530f27a0d43cf227cdc9389192d5c3296abca41dccd3ccd8f39939b68bb9b7
SHA512

81f811500d32b8987cda6615e89b643cebd8267a87c493b987c42267bb7d3bc9baa98d0c7836abc8e99b57e040bf36bc8a09f54c93c16004e212f8ada80c47e6
SSDEEP

3072:u5zBfMejPyYcH0Bx7r6+t7XY7UZJlYg7DH7226o/jnzbFgk0HWGhPWWckj0:GzBfNu7H6q+GS7ao/jnaWGhPW3

Score

10^/10

smokeloader pub1 backdoor persistence trojan vmprotect

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

rc4.i32

Targets

- Target
  
  abc5152266564f883ab915f2a1eec762cd98920e5e315974c926632942e31976.exe
- Size
  
  313KB
- MD5
  
  49c1a7094df766b5e5868811f298b529
- SHA1
  
  c48fc045b5ee06e02d558f3c3551a463199725b9
- SHA256
  
  abc5152266564f883ab915f2a1eec762cd98920e5e315974c926632942e31976
- SHA512
  
  c34cf47f715fffb4c4b9ec4ba587ea0c455d3baf7192408114b9f7260dbb1ee6b28c794157cfdd12c6048e99e9140220d77232bd9355cb96db7df9e566ba9490
- SSDEEP
  
  3072:9gw3B7c4wkQMR+BYYeEX+qP4XTkedBoRv0XgGlf+N9XF6kVQvVYKAG:zxd/RmFMkeAv0ltKXF6k2NvJ
Score

10^/10

smokeloader pub1 backdoor persistence trojan vmprotect
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Modifies Installed Components in the registry
  persistence
- Deletes itself
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoorpersistencetrojanvmprotect

behavioral2

smokeloaderpub1backdoortrojan