General
-
Target
7755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9
-
Size
240KB
-
Sample
240418-2qgg3saa61
-
MD5
bfe9ca3a9060f8b106ef1e7448416289
-
SHA1
aa2e83375485435a6bc81aa59e769b4888dc9ca2
-
SHA256
7755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9
-
SHA512
b52c1733e3b7c39da85603e1ea8013d1b1e69a4c5d9d91d64e6ab0234408f091cab8ea10a0034d8c0b88d7a21a9317591796d4c6015bf8454dec65f21e642a36
-
SSDEEP
3072:L0LhLBEcMX2oGfC33bMuLeof5Okopz3Ob:L0LhVMmtiX6JkW3U
Static task
static1
Behavioral task
behavioral1
Sample
7755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9.exe
Resource
win10-20240404-en
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Targets
-
-
Target
7755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9
-
Size
240KB
-
MD5
bfe9ca3a9060f8b106ef1e7448416289
-
SHA1
aa2e83375485435a6bc81aa59e769b4888dc9ca2
-
SHA256
7755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9
-
SHA512
b52c1733e3b7c39da85603e1ea8013d1b1e69a4c5d9d91d64e6ab0234408f091cab8ea10a0034d8c0b88d7a21a9317591796d4c6015bf8454dec65f21e642a36
-
SSDEEP
3072:L0LhLBEcMX2oGfC33bMuLeof5Okopz3Ob:L0LhVMmtiX6JkW3U
Score10/10-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Deletes itself
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1