smokeloader | 0c9ead5b48e9c701fbeb7f9c23879127e9f56473b63a2edcc865cd2165e742fe | Triage

Sharing

General

Target

0c9ead5b48e9c701fbeb7f9c23879127e9f56473b63a2edcc865cd2165e742fe
Size

317KB
Sample

220125-mk5kdsecg8
MD5

514fd21fe58287d5a45596da745c93c3
SHA1

8b6e9ffb7460644f89f635265bd970df4875fd77
SHA256

0c9ead5b48e9c701fbeb7f9c23879127e9f56473b63a2edcc865cd2165e742fe
SHA512

cd2d4759c52b488e537618a664b2505b1503f6664d3282e3098b29f3cc8793808ee8f3ff385413917d725882b4c56b12cb42a42e0be66e9997e9e4ed6f922bd2

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  0c9ead5b48e9c701fbeb7f9c23879127e9f56473b63a2edcc865cd2165e742fe
- Size
  
  317KB
- MD5
  
  514fd21fe58287d5a45596da745c93c3
- SHA1
  
  8b6e9ffb7460644f89f635265bd970df4875fd77
- SHA256
  
  0c9ead5b48e9c701fbeb7f9c23879127e9f56473b63a2edcc865cd2165e742fe
- SHA512
  
  cd2d4759c52b488e537618a664b2505b1503f6664d3282e3098b29f3cc8793808ee8f3ff385413917d725882b4c56b12cb42a42e0be66e9997e9e4ed6f922bd2
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan