smokeloader | 5513819b1b1dfe45e3662aaec8f4ecc598ff20e3b7d929be68ead40c855dcb10 | Triage

Sharing

General

Target

200617-sg254llg2s_pw_infected.zip
Size

29KB
Sample

200617-wcac4bn5l2
MD5

73d92bcb359a9bce943f9f80fb39bb77
SHA1

e585cfd021fdb936df379fe644f9db2817fc73c7
SHA256

5513819b1b1dfe45e3662aaec8f4ecc598ff20e3b7d929be68ead40c855dcb10
SHA512

4c0cb89d290531314216518235a28d47fbeb30359678369d2d55fd3f287152bc9b4ddafdb3e2a2ae0ecb4572a6ce63c7b3ce907d6c26addb598c955537167c18

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://185.35.137.147/mlp/

rc4.i32

rc4.i32

Targets

- Target
  
  37ea915af4b89c5697fd8647175dbc25
- Size
  
  32KB
- MD5
  
  37ea915af4b89c5697fd8647175dbc25
- SHA1
  
  b0b41abda47839c37c007f4c9e03dfad55084f70
- SHA256
  
  383dede6a6d363e97a2d34a002aca69378da4b6769b13976b0344a20272a7d9d
- SHA512
  
  f0ad407facf9801a2e25ca0c1b495f7c93cb633f1c2416c6b412d11108bec67018eb08928181318be1cc259e48a7cc2c5995b7467e7b93a641f048299e824596
Score

10^/10

trojan backdoor smokeloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

trojanbackdoorsmokeloader

behavioral2

trojanbackdoorsmokeloader