General
-
Target
4da76547d7081b68f3af83c77a5c75b2ff3f0691d7c58aca34632ff2ecd1e98c
-
Size
307KB
-
Sample
240418-2jmerahg8x
-
MD5
a11d2533c5dd2b17161fc2eea2ba1bef
-
SHA1
f7f42c054b83cb0cc3bb0a54a75195f920d9ced8
-
SHA256
4da76547d7081b68f3af83c77a5c75b2ff3f0691d7c58aca34632ff2ecd1e98c
-
SHA512
0053214e42b72365bd435ab8f35e4ddc8774c347dfa57d90c9f49c81b23dd1178f0a77b0facb0cce0d29b67b33eb7243a5c7c4f267274374e095a47f4a301a0b
-
SSDEEP
3072:PAeYeaG3VkbDb3fUv+3lSYS+gPdNoMDBNxCkV8lhFna/c2Soqv9m:P0NbFVrSndyNFa/c2SHl
Static task
static1
Behavioral task
behavioral1
Sample
4da76547d7081b68f3af83c77a5c75b2ff3f0691d7c58aca34632ff2ecd1e98c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4da76547d7081b68f3af83c77a5c75b2ff3f0691d7c58aca34632ff2ecd1e98c.exe
Resource
win10-20240404-en
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Targets
-
-
Target
4da76547d7081b68f3af83c77a5c75b2ff3f0691d7c58aca34632ff2ecd1e98c
-
Size
307KB
-
MD5
a11d2533c5dd2b17161fc2eea2ba1bef
-
SHA1
f7f42c054b83cb0cc3bb0a54a75195f920d9ced8
-
SHA256
4da76547d7081b68f3af83c77a5c75b2ff3f0691d7c58aca34632ff2ecd1e98c
-
SHA512
0053214e42b72365bd435ab8f35e4ddc8774c347dfa57d90c9f49c81b23dd1178f0a77b0facb0cce0d29b67b33eb7243a5c7c4f267274374e095a47f4a301a0b
-
SSDEEP
3072:PAeYeaG3VkbDb3fUv+3lSYS+gPdNoMDBNxCkV8lhFna/c2Soqv9m:P0NbFVrSndyNFa/c2SHl
Score10/10-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Deletes itself
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1