smokeloader | 3e3a03be92c83691f24bf8f09f0dd796caf087ef9d2e201b82fc4be6bac5317a | Triage

Sharing

General

Target

3e3a03be92c83691f24bf8f09f0dd796caf087ef9d2e201b82fc4be6bac5317a
Size

318KB
Sample

220125-fcsgjagge5
MD5

c079bb348347b05b75deb63f5edca976
SHA1

ceeb19c9df259ac0c24b481d4996bdbc385cc6a5
SHA256

3e3a03be92c83691f24bf8f09f0dd796caf087ef9d2e201b82fc4be6bac5317a
SHA512

8081a793aad6c7dc009da9c8619acc4c72ee8de0404613f6409b03effe22feec2f7e1f76f84274cfec0b0f02ac607995b10e2a88a5a8d3ec6a37be54106c9a3b

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  3e3a03be92c83691f24bf8f09f0dd796caf087ef9d2e201b82fc4be6bac5317a
- Size
  
  318KB
- MD5
  
  c079bb348347b05b75deb63f5edca976
- SHA1
  
  ceeb19c9df259ac0c24b481d4996bdbc385cc6a5
- SHA256
  
  3e3a03be92c83691f24bf8f09f0dd796caf087ef9d2e201b82fc4be6bac5317a
- SHA512
  
  8081a793aad6c7dc009da9c8619acc4c72ee8de0404613f6409b03effe22feec2f7e1f76f84274cfec0b0f02ac607995b10e2a88a5a8d3ec6a37be54106c9a3b
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan