Overview

overview

10

Static

static

3

d7b4f35ff3...18.exe

windows7-x64

10

d7b4f35ff3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7b4f35ff3c660a0dbfc3ce84a74680d_JaffaCakes118

  • Size

    83KB

  • Sample

    240910-g5a9dszemm

  • MD5

    d7b4f35ff3c660a0dbfc3ce84a74680d

  • SHA1

    eb98f8f283ff2eb7b57a22ebac15978b790fb47f

  • SHA256

    d1542300c9eb8ca823956917aeb23fcf00753a11c3fc5a26586e29757ec3a64f

  • SHA512

    ac34c7b1c481bd1cc019720827e7e2cdba956860f514debcd24d6e97a2373320afbd2e287875c4d5dd7b41fdc4392eea0419927f2cfb04b522aab114be4abc57

  • SSDEEP

    768:eUGKKDVX7piAfvR3uQCQ88ZcoexnnnnnnnnnnnnnnnnnnSqlzI4KklsugzPjk+Ok:ePDRN7Rl7cLa4Kk8zLkpioU/qfxTzdq

Score
10/10
smokeloaderyyy3backdoordiscoverytrojan

Malware Config

Extracted

Family

smokeloader

Botnet

yyy3

Extracted

Family

smokeloader

Version

2018

C2

http://bloomedanticipated.bid/

http://vijayanagarsanodynes.bid/

http://rabelaissbackgammon.bid/
rc4.i32
rc4.i32

Targets

    • Target

      d7b4f35ff3c660a0dbfc3ce84a74680d_JaffaCakes118

    • Size

      83KB

    • MD5

      d7b4f35ff3c660a0dbfc3ce84a74680d

    • SHA1

      eb98f8f283ff2eb7b57a22ebac15978b790fb47f

    • SHA256

      d1542300c9eb8ca823956917aeb23fcf00753a11c3fc5a26586e29757ec3a64f

    • SHA512

      ac34c7b1c481bd1cc019720827e7e2cdba956860f514debcd24d6e97a2373320afbd2e287875c4d5dd7b41fdc4392eea0419927f2cfb04b522aab114be4abc57

    • SSDEEP

      768:eUGKKDVX7piAfvR3uQCQ88ZcoexnnnnnnnnnnnnnnnnnnSqlzI4KklsugzPjk+Ok:ePDRN7Rl7cLa4Kk8zLkpioU/qfxTzdq

    Score
    10/10
    smokeloaderyyy3backdoortrojandiscovery

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks