smokeloader | e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b | Triage

Sharing

General

Target

e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b
Size

146KB
Sample

210926-jkpmdseear
MD5

a2c3621da84721bdf0694d6b9385502a
SHA1

3b13e4d0900463e4369ec2e71526d3efbdc53211
SHA256

e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b
SHA512

c8bccc204403d42dfb8fa67b91818a53c40924b9a5be9c2490a85a97fe12e8a44c5510b40231a2dacc4b55e253bda238c42bdcfeac4b892487b35b43d08fca17

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

rc4.i32

Targets

- Target
  
  e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b
- Size
  
  146KB
- MD5
  
  a2c3621da84721bdf0694d6b9385502a
- SHA1
  
  3b13e4d0900463e4369ec2e71526d3efbdc53211
- SHA256
  
  e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b
- SHA512
  
  c8bccc204403d42dfb8fa67b91818a53c40924b9a5be9c2490a85a97fe12e8a44c5510b40231a2dacc4b55e253bda238c42bdcfeac4b892487b35b43d08fca17
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan