smokeloader | 30846463742bd78d63dfb610367ad3d055c1ab3aa4675d1776219599b0a6e5e9 | Triage

Sharing

General

Target

30846463742bd78d63dfb610367ad3d055c1ab3aa4675d1776219599b0a6e5e9
Size

317KB
Sample

220125-hkcgdsafh3
MD5

649aab4a3df8250b9c88c68dc14ed57a
SHA1

1ef39081938c23072efaa9200bbf3ac0fe1371a7
SHA256

30846463742bd78d63dfb610367ad3d055c1ab3aa4675d1776219599b0a6e5e9
SHA512

82916027abac3e53bfa5b9a5d1b6ae10de5c73e3cfef40e0f30f766390dd78040da487cd9fc544480807cb11de81062b9328267a1ac2ae285ce975fd9083c3b5

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  30846463742bd78d63dfb610367ad3d055c1ab3aa4675d1776219599b0a6e5e9
- Size
  
  317KB
- MD5
  
  649aab4a3df8250b9c88c68dc14ed57a
- SHA1
  
  1ef39081938c23072efaa9200bbf3ac0fe1371a7
- SHA256
  
  30846463742bd78d63dfb610367ad3d055c1ab3aa4675d1776219599b0a6e5e9
- SHA512
  
  82916027abac3e53bfa5b9a5d1b6ae10de5c73e3cfef40e0f30f766390dd78040da487cd9fc544480807cb11de81062b9328267a1ac2ae285ce975fd9083c3b5
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan