Overview

overview

10

Static

static

1

793a58e683...5.html

windows7-x64

10

793a58e683...5.html

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    793a58e683a54d24d3c6bae96df29d65.zip

  • Size

    1KB

  • Sample

    240827-fb3k4stbjc

  • MD5

    bbafdc4d245456ca69350f1502c04f80

  • SHA1

    8b57ec3f6be2bdd6535d57e75507b51155209452

  • SHA256

    740ea75a107ba0d8245192a1f0906b206cf797f9e11fcd815dfed1a86798797c

  • SHA512

    eeca356dc26773bf7844cca8bfce54843b446629ab0d4ffa04f13095ff88c3d5901e1edfa0565d92c4e431c7758e90f3e94c640494d8ae507040fe2e2d85f2f0

Score
10/10
smokeloaderbackdoordiscoverytrojan

Malware Config

Targets

    • Target

      793a58e683a54d24d3c6bae96df29d65

    • Size

      8KB

    • MD5

      e0b75bc23482fdc078b4dd694c49c4bb

    • SHA1

      c9503d1020a26d6ccbf0da9bf2f86d5ba034d347

    • SHA256

      dd51d6eeee76165192540548e2ac8fef08870afae3cc73c50b3687f8f8242f5f

    • SHA512

      0da5ed0187fb01027471cb0b07aaaac75e4c3964e64c50e09d398dc8a74e0ba75b8cef3f30949c082319f8546f455d0232ed05a99d4213ff4928502c37adb918

    • SSDEEP

      96:tS9qSotSBnHZ9R2va5keK3MbIxaopFztWDnOLnA/:twot8nHTUgahWD6M

    Score
    10/10
    smokeloaderbackdoordiscoverytrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks