Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e

  • Size

    283KB

  • Sample

    240425-be85vace83

  • MD5

    ace2b92a3208dec19577cbac84d543b2

  • SHA1

    c40b8908ebbfa819c3581ec85bfca66bca77b605

  • SHA256

    1d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e

  • SHA512

    e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f

  • SSDEEP

    3072:KiD09rKj/em+qxnnoVL0OA18WIyXpOx9E7sFW7CsZONbo0r5EK4kwgpG:YY6mM7A18B9NFW7CswRZr5E

Score
10/10
smokeloaderpub1backdoorbootkitpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Targets

    • Target

      1d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e

    • Size

      283KB

    • MD5

      ace2b92a3208dec19577cbac84d543b2

    • SHA1

      c40b8908ebbfa819c3581ec85bfca66bca77b605

    • SHA256

      1d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e

    • SHA512

      e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f

    • SSDEEP

      3072:KiD09rKj/em+qxnnoVL0OA18WIyXpOx9E7sFW7CsZONbo0r5EK4kwgpG:YY6mM7A18B9NFW7CswRZr5E

    Score
    10/10
    smokeloaderpub1backdoorbootkitpersistencetrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks