smokeloader | a94aa8a872bc11c2a3b4e64eb702f023dc137bb30cd6f47cd07621e30da8aa35 | Triage

Resubmissions

03-12-2021 20:29

211203-y9kr3ahdak 10

03-12-2021 20:05

211203-ytv8vscbh9 10

Sharing

General

Target

a94aa8a872bc11c2a3b4e64eb702f023dc137bb30cd6f47cd07621e30da8aa35
Size

318KB
Sample

211203-y9kr3ahdak
MD5

1efb128e8c641d5f8154ba2e7208a275
SHA1

04dfb40fbc07359916089bdec47850e32b3338af
SHA256

a94aa8a872bc11c2a3b4e64eb702f023dc137bb30cd6f47cd07621e30da8aa35
SHA512

826be6f214919e0a7724206599c3c0aaa3e88aa51d9fd830ae67680f71f025b451b40a71fd031724234c2f7a283f80c9fc17ff2d4ebaa0206636e8a22d4cb0d9

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  a94aa8a872bc11c2a3b4e64eb702f023dc137bb30cd6f47cd07621e30da8aa35
- Size
  
  318KB
- MD5
  
  1efb128e8c641d5f8154ba2e7208a275
- SHA1
  
  04dfb40fbc07359916089bdec47850e32b3338af
- SHA256
  
  a94aa8a872bc11c2a3b4e64eb702f023dc137bb30cd6f47cd07621e30da8aa35
- SHA512
  
  826be6f214919e0a7724206599c3c0aaa3e88aa51d9fd830ae67680f71f025b451b40a71fd031724234c2f7a283f80c9fc17ff2d4ebaa0206636e8a22d4cb0d9
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan