Overview

overview

10

Static

static

3

b0f1d6defb...48.exe

windows7-x64

10

b0f1d6defb...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b7c3bb96de559fa8bc7daf8e30c79be505dfe4e2de4411baf7f4cb68f979452

  • Size

    162KB

  • Sample

    240417-qmrcbshc47

  • MD5

    e5f3b9b7b9c877796a52835f7a4828c1

  • SHA1

    ee55463df6e132c8d97470570ebd35284e1ea452

  • SHA256

    7b7c3bb96de559fa8bc7daf8e30c79be505dfe4e2de4411baf7f4cb68f979452

  • SHA512

    6b4f56a1f7bbab9570577ccdbf7f95198179f2c221d0d4036b9caf929f5a1e152110ba7d3e5a4ed95a2e4c7e37123e294e95374778569f901de78ea95da5e101

  • SSDEEP

    3072:9p9sFUJZtSaLMueA2CIpXochVuTGR0f6lSxID9/AL8Lp+hdyXwv8uo:9bJZtvLNArOVTA0fKJDdAL8Fuygv8uo

Score
10/10
smokeloaderpub1backdoorpersistencetrojanvmprotect

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Targets

    • Target

      b0f1d6defb63ca51dce41219e35f97ab8d89ec19c863f5b659fb8b05c1c92248.exe

    • Size

      308KB

    • MD5

      60f468fb140a2497c65273bbaccb51f7

    • SHA1

      fd5ce406c85ec123c40eef3969cb44f32997159f

    • SHA256

      b0f1d6defb63ca51dce41219e35f97ab8d89ec19c863f5b659fb8b05c1c92248

    • SHA512

      38bdf0d78d0c90f7e1ee7e0b0d0e455b0b004a3e9c0dc8ba7f11a3902d8652829e870b6a70215df6bec410308e0ffca84a1f6aa6ec9674db365200fbd19a059e

    • SSDEEP

      3072:FGmUR5WgfI91+oYYCEXXhRwtnm4r/xHyhnpIGrI5KSWA612UIK:ZURzw1zRDwtnfrsRHrcU/

    Score
    10/10
    smokeloaderpub1backdoorpersistencetrojanvmprotect

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks