smokeloader | 73c9bb2632bfa7f213c3147a0840a893bf66bae988bf1d02a54c9098a202692e | Triage

Sharing

General

Target

73c9bb2632bfa7f213c3147a0840a893bf66bae988bf1d02a54c9098a202692e
Size

145KB
Sample

210925-3t2g4aeaf4
MD5

7e2087a79b5fc0cfcc5561f65940ecbf
SHA1

52c9cbabe18d53a72297d026e63f81e9741dec7f
SHA256

73c9bb2632bfa7f213c3147a0840a893bf66bae988bf1d02a54c9098a202692e
SHA512

d197d34b19bb4682e97ccd68b617763a80d326faaa7d3730812bf5318d0785ce10568faf538703b29b561d7a1a37e5ad0a2b9fb36a7685ddd9558611983e4c63

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

rc4.i32

Targets

- Target
  
  73c9bb2632bfa7f213c3147a0840a893bf66bae988bf1d02a54c9098a202692e
- Size
  
  145KB
- MD5
  
  7e2087a79b5fc0cfcc5561f65940ecbf
- SHA1
  
  52c9cbabe18d53a72297d026e63f81e9741dec7f
- SHA256
  
  73c9bb2632bfa7f213c3147a0840a893bf66bae988bf1d02a54c9098a202692e
- SHA512
  
  d197d34b19bb4682e97ccd68b617763a80d326faaa7d3730812bf5318d0785ce10568faf538703b29b561d7a1a37e5ad0a2b9fb36a7685ddd9558611983e4c63
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan