Overview

overview

10

Static

static

3

a95bc0eeb6...3b.exe

windows7-x64

10

a95bc0eeb6...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e005ae3ad498f03e3b291b80d0755505381bd7751d1261b04d9b874cd5400d3

  • Size

    150KB

  • Sample

    240417-rsq47add51

  • MD5

    bb6fcf4f1199e7968e99f567187882ce

  • SHA1

    350d339b5cea5c16e62c149b27a358ceed8ef9e7

  • SHA256

    5e005ae3ad498f03e3b291b80d0755505381bd7751d1261b04d9b874cd5400d3

  • SHA512

    b1bb752a9571b9af45ec3766f62d7e59a29bfcb17a85cc62b60aca4cdc9a1d2ca5513fb9338278c4e208300ac83abfb636023f6217d3c46527f2d81b57e823a4

  • SSDEEP

    3072:c0v3xyTwmcYIUsZwtyEUy7GO9oCh1/dIo5B6by11si0IISBHO/mg5cvzk:zv3xyTfcYIvZIyEUyaO9NDeyUkHGFCzk

Score
10/10
smokeloaderpub1backdoorpersistencetrojanvmprotect

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Targets

    • Target

      a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe

    • Size

      233KB

    • MD5

      36c3af072c2fcd97d5815cf8dd15027f

    • SHA1

      36e732bc75dbb1d262c163c9b9561ac42fb0c430

    • SHA256

      a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b

    • SHA512

      16a6d4c39b79e9e8ffc35b5562837141ecf8c05059b626aa8d6e56e295fbcaf6c5f7d2cc4b210b2524c98c64207295b4ad3be9b56fada32a745c6e05ab55733d

    • SSDEEP

      3072:QOwPX0z03zFWn4ZYBmb6H4IU0htFBDDwyIK0Y1aP8AXMsS518anEQwug3JB:E9FW4yH3UGtvUjq7q

    Score
    10/10
    smokeloaderpub1backdoorpersistencetrojanvmprotect

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks