smokeloader | 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e | Triage

Sharing

General

Target

858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
Size

145KB
Sample

210926-jnb6gaeebm
MD5

924b06fed5002d7dbc6004401b7a519f
SHA1

669962749b03a129e44c6eec9ef2804ec31493f4
SHA256

858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA512

7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

rc4.i32

Targets

- Target
  
  858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
- Size
  
  145KB
- MD5
  
  924b06fed5002d7dbc6004401b7a519f
- SHA1
  
  669962749b03a129e44c6eec9ef2804ec31493f4
- SHA256
  
  858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
- SHA512
  
  7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan