smokeloader | f637dd9e894c195d97f6ca857dc426b1b3cc6fd3a9d99aed10ea7a2a87144c62 | Triage

Sharing

General

Target

f637dd9e894c195d97f6ca857dc426b1b3cc6fd3a9d99aed10ea7a2a87144c62
Size

317KB
Sample

220125-lp88psddf8
MD5

df2f6b6e81079e15ce66976b2b771f9c
SHA1

c215bd6f5bc3b3f6cb10f80319e045b4f58535af
SHA256

f637dd9e894c195d97f6ca857dc426b1b3cc6fd3a9d99aed10ea7a2a87144c62
SHA512

b6c6e90c335204aa1b8f460a96570c5fd76554a3d692b02db942a907dfd797d6469671370c23112e46fc23c61ef80413d452852e9badb0607eed64835832d115

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  f637dd9e894c195d97f6ca857dc426b1b3cc6fd3a9d99aed10ea7a2a87144c62
- Size
  
  317KB
- MD5
  
  df2f6b6e81079e15ce66976b2b771f9c
- SHA1
  
  c215bd6f5bc3b3f6cb10f80319e045b4f58535af
- SHA256
  
  f637dd9e894c195d97f6ca857dc426b1b3cc6fd3a9d99aed10ea7a2a87144c62
- SHA512
  
  b6c6e90c335204aa1b8f460a96570c5fd76554a3d692b02db942a907dfd797d6469671370c23112e46fc23c61ef80413d452852e9badb0607eed64835832d115
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan