smokeloader | e539faa062b0aefbf32f84e2b757fc1e40b2f53eb1aad7fdf942e5b594e63915 | Triage

Sharing

General

Target

e539faa062b0aefbf32f84e2b757fc1e40b2f53eb1aad7fdf942e5b594e63915
Size

146KB
Sample

210926-k4fz2aefd2
MD5

11ba4d8cf0672a4fb26246153bace4d6
SHA1

50f558886a3ffac0f398a2d65a6e4b1ae199d655
SHA256

e539faa062b0aefbf32f84e2b757fc1e40b2f53eb1aad7fdf942e5b594e63915
SHA512

04dbdd9606d43726bbe0a5e3b48e07cfb59c5085eb9a4da1bfcd599045b8917b2637ab8ae389550b8489c3e383b38972c6a3eb603df5a72e93fc62cdc3d545e8

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

rc4.i32

Targets

- Target
  
  e539faa062b0aefbf32f84e2b757fc1e40b2f53eb1aad7fdf942e5b594e63915
- Size
  
  146KB
- MD5
  
  11ba4d8cf0672a4fb26246153bace4d6
- SHA1
  
  50f558886a3ffac0f398a2d65a6e4b1ae199d655
- SHA256
  
  e539faa062b0aefbf32f84e2b757fc1e40b2f53eb1aad7fdf942e5b594e63915
- SHA512
  
  04dbdd9606d43726bbe0a5e3b48e07cfb59c5085eb9a4da1bfcd599045b8917b2637ab8ae389550b8489c3e383b38972c6a3eb603df5a72e93fc62cdc3d545e8
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan