Overview

overview

10

Static

static

3

e9839a31cc...7e.exe

windows7-x64

10

e9839a31cc...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    797555d1ed9828989e74389d6d7a1aaedfac074b7f45bb30cf71e6ad22ddb4f6

  • Size

    144KB

  • Sample

    240417-qjdxtsae7v

  • MD5

    f18bb574feeb06e8bf42044fea693084

  • SHA1

    868f83f40544c02b6e2ece2b2b505e36c7e7a6c6

  • SHA256

    797555d1ed9828989e74389d6d7a1aaedfac074b7f45bb30cf71e6ad22ddb4f6

  • SHA512

    9bb2ca4a7f591309011d97deaff18ce6a4e495c1b99754070f765dd9f767aacde1c424514bff3c029e0d78a30df4ad338b128bba319d2c0e8f1687c7af02065f

  • SSDEEP

    3072:XlCRkSLro8mK3ThMAzdqVyGT2j8c8rGONq8Z/iuurkF:XlC7LEcrzdqZcwGONxuAF

Score
10/10
smokeloaderpub1backdoorpersistencetrojanvmprotect

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Targets

    • Target

      e9839a31cca5038608b57f6e13e75f43aa845a2f892c917a77b3c4f0bcc35c7e.exe

    • Size

      259KB

    • MD5

      b05a74505fa03339578dff002ba57c69

    • SHA1

      b9851e84dbd2c8b2ecccb30452ddccb0496ef974

    • SHA256

      e9839a31cca5038608b57f6e13e75f43aa845a2f892c917a77b3c4f0bcc35c7e

    • SHA512

      616337efd4b6a84f0590226b52d8c7398723afe43bb1fc879089a7474b7fd8949e16353bb4ff713da4295dbc4885d5eb34d9483d7441b726592371bb8f285dd3

    • SSDEEP

      3072:NCEgl6HLc0iImEkhg569+wjkabBB2n2qr4j54wCxe9yFfqdwiB9ez/WnQEbK3Zk:NsUrc06Fue/kZr4j5vwbb0WWnQEbe

    Score
    10/10
    smokeloaderpub1backdoorpersistencetrojanvmprotect

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks