Overview

overview

10

Static

static

3

cus.exe

windows7-x64

10

cus.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cus.exe

  • Size

    13KB

  • Sample

    240521-jwwvvadh4w

  • MD5

    39023ce4acf0cab299648ba78a68c52d

  • SHA1

    1ac1a55650e2a278c9264ac7a8d540c84c141a43

  • SHA256

    3ff5ee87b0502f4c2fa61e140caeb00540fb2eeea7f5326cfded837e6dd330aa

  • SHA512

    5da1c4feb379e5e1887f4c6e129bb5cc0c9a626114232873233d26cb11f61e7d7330d3181a4f07e61eaa9bb0cc981fcb71dcf61834abfd7c343ffccb9b6cac6e

  • SSDEEP

    192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4OtN:JAnLAXNy/m3/bTKN

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://dogewareservice.ru/

Targets

    • Target

      cus.exe

    • Size

      13KB

    • MD5

      39023ce4acf0cab299648ba78a68c52d

    • SHA1

      1ac1a55650e2a278c9264ac7a8d540c84c141a43

    • SHA256

      3ff5ee87b0502f4c2fa61e140caeb00540fb2eeea7f5326cfded837e6dd330aa

    • SHA512

      5da1c4feb379e5e1887f4c6e129bb5cc0c9a626114232873233d26cb11f61e7d7330d3181a4f07e61eaa9bb0cc981fcb71dcf61834abfd7c343ffccb9b6cac6e

    • SSDEEP

      192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4OtN:JAnLAXNy/m3/bTKN

    Score
    10/10
    smokeloaderbackdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks