6b3ca7c198a8f1a37ae6d1f9925e280ffb57d0b3780abd46e3b63aa9cb32ab6b

General

Target
7Smoker Pro 2.0.rar
Size 2.0MB
Sample260812-s9xtqszfrd
SHA256 6b3ca7c198a8f1a37ae6d1f9925e280ffb57d0b3780abd46e3b63aa9cb32ab6b
MD5 03b5e036c71ed5be0d0deec9a5119341
SHA1 0103ecdc26ad671cc133c3956429293e982ddf70
SHA512 870d140c1b931358b586d66c9333f541756614ad61caacccaa5e577022f1b79bd3b78a5939992568699f86cde77da3793d7fa393a51b368afa92df1d06c76379
SSDEEP 49152:PuY+19R5kMGPZlMiyin4t0xSS3vMncB0h+utGNLc:PuY+1f3nBgv3vrBQD
TLSH
T1F8A533F152A31CE60C4EB7E1AD102E5BC709060C5DD24EAEFB94A4F769DFE02639C199
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  7Smoker Pro 2.0/7Smoker Pro 2.0.exe
- Size 146KB
- SHA256 365e49cc31e284e7e33088ea81f6995495f001ad497088bc81572a3d8a64e454
- MD5 71a7d6ad78e98e09bef1326427dfb144
- SHA1 38918cc54cfa238ada103afb6bab6868db750aae
- SHA512 5eacdbef8eedd3ebe267b3d1933bc065f5c0aad51f24847612c7bf1ed7fd77522338db5f78b1322a1a049b0cb634cc6897db1584ff9d2215f0dd79f61d5d1dd5
- SSDEEP 1536:f4lAePxJXdLXrnu2lAK/8n7cJCrHj899WZoZfKZKqK3YWPTnsxn0uIPE:f4lAILPlroHj8XWZ0fmK5IHxn8M
- TLSH
  T145E35BAAA7087C91DD1A57B28032D6792670BC72A7F1211D36F9FF3FA1B32065407326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution installer persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral1
- Target
  7Smoker Pro 2.0/WinTypes/.gitattributes.exe
- Size 1.6MB
- SHA256 17bd875b76b60688fabb72bdecb71e5281b3fa186e0391bb9260dd6abc7147f1
- MD5 abcaf24a058ff06816c16fa79666ecee
- SHA1 1f9ce0a43402b034689cd14fd2792e0b647c697a
- SHA512 d179584e9d1f50d70fe96c33b6aa79943c35604fb2b64091ba951aa3eaa0b7ab16c4391213a32ba48b2a110194da62871f4faab39a7cf6993a9e7f0414f55613
- SSDEEP 49152:C9tkZTv7a8bpNPFnYaZPRSp4R3kzRED+p6Di:MtkV7a8bpTZPRHloRED2ki
- TLSH
  T1E38533AFCA91AA31E029ED3C0F69D0149F2E3E185538715270ED4D7A5F376229B187E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
behavioral2
- Target
  7Smoker Pro 2.0/WinTypes/Ionic.Zip.dll
- Size 480KB
- SHA256 17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89
- MD5 f6933bf7cee0fd6c80cdf207ff15a523
- SHA1 039eeb1169e1defe387c7d4ca4021bce9d11786d
- SHA512 88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6
- SSDEEP 6144:OhagC/Mq25o9sXGtSV41OJDsTDDVUMle6ZjxLV/kHu4Bht79I9:iagxWS4msNUCe65fkHdBf9
- TLSH
  T183A4AD0427E90A55F4BE5BBAC0B69260C3B1B4166D6FD70F4EE020EE2D37790D9147AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  7Smoker Pro 2.0/WinTypes/Launcher.exe
- Size 53KB
- SHA256 0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32
- MD5 c6d4c881112022eb30725978ecd7c6ec
- SHA1 ba4f96dc374195d873b3eebdb28b633d9a1c5bf5
- SHA512 3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981
- SSDEEP 768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5
- TLSH
  T11B332A489A4C9773C9ED46BE98E366904375C02B6B47E70FBC8982345E133EA194279F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral4
- Target
  7Smoker Pro 2.0/platform.js
- Size 87B
- SHA256 a319126b701f722a192e0653d2698b8d855e43d56153069ad1255879a0affcb7
- MD5 e3c0b603d8720a81116319d44ee421e6
- SHA1 6b7554f4fb3f1a4f22c1b09f0d1e84eb9438450b
- SHA512 b398fc5f36d54ac60f6487bf950298c03ba9a01821164973c1b999d4d63b280e2271749be803bdfb9593642b79fbf6a8546eb15684b1496bf0432deab21afa6f
- TLSH
  T183B0120019519C420330110260C713261539139B006B90088055411D9450F52C55F1B6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5