smokeloader | 3c3dad766a284f3fc74ae1727ef048534076b06756da7fde43802a90b0efeb86 | Triage

Resubmissions

19-04-2021 06:32

210419-pzc59b8zd2 10

19-04-2021 06:21

210419-8mj9kyhtqe 10

Sharing

General

Target

рахунок № 00163-2021.js
Size

73KB
Sample

210419-pzc59b8zd2
MD5

6faf0f67320408b8f5bfd9562f5ca6a6
SHA1

e67ef7d6424f45fb2f3fa6fb3a677e621f8eea05
SHA256

3c3dad766a284f3fc74ae1727ef048534076b06756da7fde43802a90b0efeb86
SHA512

0e0320d3c9429e49acd0a4cb666435325569cd637f0be6378908fb35035fdf3a3617a781b5607e4ca29219c263eec285ccfbf84f820da7570400490a1f09b9d1

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://smbproperty.ru/

http://gmbshop.ru/

http://baksproperty.gov.ug/

http://magistralpsw.ru/

http://mpmanagertzz.ru/

http://powerglasspot.ru/

http://autopartswarehouses.ru/

http://memoloves.ru/

http://alfavanilin.ru/

rc4.i32

rc4.i32

Targets

- Target
  
  рахунок № 00163-2021.js
- Size
  
  73KB
- MD5
  
  6faf0f67320408b8f5bfd9562f5ca6a6
- SHA1
  
  e67ef7d6424f45fb2f3fa6fb3a677e621f8eea05
- SHA256
  
  3c3dad766a284f3fc74ae1727ef048534076b06756da7fde43802a90b0efeb86
- SHA512
  
  0e0320d3c9429e49acd0a4cb666435325569cd637f0be6378908fb35035fdf3a3617a781b5607e4ca29219c263eec285ccfbf84f820da7570400490a1f09b9d1
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Query Registry

Peripheral Device Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan