smokeloader | f60102ecece017c014598d192f756b6c3fbf7f19ce82653be9dd9cd5e049f03f | Triage

Sharing

General

Target

f60102ecece017c014598d192f756b6c3fbf7f19ce82653be9dd9cd5e049f03f
Size

317KB
Sample

220125-2d8qssgden
MD5

d25611de634a48618015bc692d6219f5
SHA1

e6845e424a8850d78346ab80934c1fedb4d89fe7
SHA256

f60102ecece017c014598d192f756b6c3fbf7f19ce82653be9dd9cd5e049f03f
SHA512

a30017e00a351a27bd765a894c53e43eeafcfd31b6013a008cf9f88e40be757005682f9a381200b7f581e30e75f8f612a14e1f4bbf8c5f9c876c9d655d6757c3

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  f60102ecece017c014598d192f756b6c3fbf7f19ce82653be9dd9cd5e049f03f
- Size
  
  317KB
- MD5
  
  d25611de634a48618015bc692d6219f5
- SHA1
  
  e6845e424a8850d78346ab80934c1fedb4d89fe7
- SHA256
  
  f60102ecece017c014598d192f756b6c3fbf7f19ce82653be9dd9cd5e049f03f
- SHA512
  
  a30017e00a351a27bd765a894c53e43eeafcfd31b6013a008cf9f88e40be757005682f9a381200b7f581e30e75f8f612a14e1f4bbf8c5f9c876c9d655d6757c3
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan