Overview

overview

10

Static

static

3

6958ACC382...D2.exe

windows11-21h2-x64

10

Resubmissions

25/04/2024, 18:41

240425-xbtfwade9710

23/02/2024, 00:25

240223-aqsrkahd3510

22/02/2024, 20:52

240222-znqxmafa7x10

22/02/2024, 17:28

240222-v17zfsdd8610

22/02/2024, 17:13

240222-vrss6sdc9210

22/02/2024, 17:01

240222-vjm8qadc3310

22/02/2024, 15:57

240222-ted9ksce5510

Sharing

Copy URL Twitter E-mail

General

  • Target
    6958ACC382E71103A0B83D20BBBB37D2.exe
  • Size 232KB
  • Sample240425-xbtfwade97
  • SHA256 078f586ebb8a22305540fb5982b2521f1b82e4317f286e13bab680fff0a9d164
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
smokeloadertfd5backdoorpersistencetrojanupx

Malware Config

Extracted

Family

  • smokeloader

Botnet

  • tfd5

Targets

    • Target
      6958ACC382E71103A0B83D20BBBB37D2.exe
    • Size 232KB
    • SHA256 078f586ebb8a22305540fb5982b2521f1b82e4317f286e13bab680fff0a9d164
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloadertfd5backdoorpersistencetrojanupx

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks