Overview

overview

10

Static

static

3

50a6f05702...a1.exe

windows7-x64

10

50a6f05702...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bfe037606ab8ddac44a687ebe58597f65b5d00f5dfd91084cde73545973b23a3

  • Size

    145KB

  • Sample

    240417-qls5jahb78

  • MD5

    9383d7d409caf863339887bc4b9e3ee6

  • SHA1

    2eec89400899c36b83bdf22e566dbdab6dfae2ef

  • SHA256

    bfe037606ab8ddac44a687ebe58597f65b5d00f5dfd91084cde73545973b23a3

  • SHA512

    5179ef0732db8615ad05f25e67b8cf524e0b3ca9c900a150374cf0019484e19f2ce8eb5bef54a6271f285e870b72c7173588abe1a967d813bd74630bdb54444d

  • SSDEEP

    3072:QfSqpTnOc3VkFMWaMVeWRHfSdAq6W9A557yOM0Y:QaU7Ot+MjW9GNrY

Score
10/10
smokeloaderpub1backdoorpersistencetrojanvmprotect

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Targets

    • Target

      50a6f0570275eb30db27eee0f78bcb07a48dcfd2ce9a9399b258114dc23c68a1.exe

    • Size

      239KB

    • MD5

      ec67029dba040a8a3f98bda4601089a6

    • SHA1

      f84940be8b8d6e729cf83c6778170bcf2e833926

    • SHA256

      50a6f0570275eb30db27eee0f78bcb07a48dcfd2ce9a9399b258114dc23c68a1

    • SHA512

      547aa205b14a928002660d12ad2a4e7d6dd4b2d78a23e97d769ff4be784fee7b73d4a9e5a34bd630971fdecdc1da58b6672dbc9e33a509c8815cf504f1121927

    • SSDEEP

      3072:SabbbkSEETZKcDDdgkrlG7Ell/1nYldm5+Xz:HxRZZgkBG7Cp1nwX

    Score
    10/10
    smokeloaderpub1backdoorpersistencetrojanvmprotect

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks