smokeloader | a847697bfb8cba01f463f430418c1751aa07a766077f2066ffbe72e3255908d3 | Triage

Sharing

General

Target

a847697bfb8cba01f463f430418c1751aa07a766077f2066ffbe72e3255908d3
Size

317KB
Sample

220125-cfrsmaedg5
MD5

05e81ae46ffc92eea49397f5172b2baf
SHA1

7a461f92fdb0b8dc5fa2345e45349233c1567aff
SHA256

a847697bfb8cba01f463f430418c1751aa07a766077f2066ffbe72e3255908d3
SHA512

a154e8cc9751678fde0bdb6410804a98ffff7149b611cfce06a228512151a7806650f53a37e0b33e6f723d668f1f5f3ccd14785d907367e79df17311230b4ceb

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  a847697bfb8cba01f463f430418c1751aa07a766077f2066ffbe72e3255908d3
- Size
  
  317KB
- MD5
  
  05e81ae46ffc92eea49397f5172b2baf
- SHA1
  
  7a461f92fdb0b8dc5fa2345e45349233c1567aff
- SHA256
  
  a847697bfb8cba01f463f430418c1751aa07a766077f2066ffbe72e3255908d3
- SHA512
  
  a154e8cc9751678fde0bdb6410804a98ffff7149b611cfce06a228512151a7806650f53a37e0b33e6f723d668f1f5f3ccd14785d907367e79df17311230b4ceb
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan