Overview

overview

10

Static

static

3

77e51b7fa8...18.exe

windows7-x64

10

77e51b7fa8...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    77e51b7fa83595cf39456c3a162a4128_JaffaCakes118
  • Size 167KB
  • Sample240527-e2kbsaga4w
  • SHA256 3e8e4989ef8a5d1b78bd13057bdb7b479b7d5491d72ead5ce4220eba3ff4d068
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2018

C2

  • http://ghjk78kjhb.net/

  • http://cleancleankkl.net/

  • http://dunujilis11r.net/

  • http://sulionuili1.in/

  • http://eseruuynli2.net/

  • http://nulikuliey.net/

  • http://oohdojssks9uf.net/

rc4.i32
rc4.i32

Targets

    • Target
      77e51b7fa83595cf39456c3a162a4128_JaffaCakes118
    • Size 167KB
    • SHA256 3e8e4989ef8a5d1b78bd13057bdb7b479b7d5491d72ead5ce4220eba3ff4d068
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloaderbackdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks