Overview

overview

10

Static

static

1

GuidanceCo...rs.exe

windows7-x64

7

GuidanceCo...rs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GuidanceConnectors.exe

  • Size

    741KB

  • Sample

    241121-tqdgesxqhq

  • MD5

    211dd0cc3da148c5bc61389693fd284f

  • SHA1

    75e6bd440e37240fee4bf7ae01109093490ac5a7

  • SHA256

    645ee0535f2ada91b101c0029f2fb71de2a27c10a5446e84d3547968ea36eafe

  • SHA512

    628bb927b5a85674ed1f762d4c42e8e9f55859cd626ab0f01b7d47ee4c74ff5775ceafc4a45864344d5dd13e588fe60b6a121b00dac79276689d0a9970d12e89

  • SSDEEP

    12288:0CUIDSqmWYzAoweej5i03v54L/sYZf2J8weqNjpnB5CLMjHgGXyPGSifD:0amqmWYde1/4LiJleEd/IMjHxplr

Score
10/10
smokeloaderbackdoordiscoverytrojan

Malware Config

Targets

    • Target

      GuidanceConnectors.exe

    • Size

      741KB

    • MD5

      211dd0cc3da148c5bc61389693fd284f

    • SHA1

      75e6bd440e37240fee4bf7ae01109093490ac5a7

    • SHA256

      645ee0535f2ada91b101c0029f2fb71de2a27c10a5446e84d3547968ea36eafe

    • SHA512

      628bb927b5a85674ed1f762d4c42e8e9f55859cd626ab0f01b7d47ee4c74ff5775ceafc4a45864344d5dd13e588fe60b6a121b00dac79276689d0a9970d12e89

    • SSDEEP

      12288:0CUIDSqmWYzAoweej5i03v54L/sYZf2J8weqNjpnB5CLMjHgGXyPGSifD:0amqmWYde1/4LiJleEd/IMjHxplr

    Score
    10/10
    discoverysmokeloaderbackdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Smokeloader family

      smokeloader

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks