smokeloader | 730a70d818d2744c00405b1829f364d997bf94b4f5b817fa49edc39c650ef2df | Triage

Sharing

General

Target

2541fb0a24ad9c6e350d4af99483bc8a.exe
Size

318KB
Sample

220125-ngkw9aehcq
MD5

2541fb0a24ad9c6e350d4af99483bc8a
SHA1

a7d5b41f0ff33e6fff4d9702fc41799124a8a99a
SHA256

730a70d818d2744c00405b1829f364d997bf94b4f5b817fa49edc39c650ef2df
SHA512

05ad08af00eddd6a04536f093c470ed0cd2ec0c3beb22117f0a08fccbef2ba8a9acdda0b70b8aa97ce807a03279077aa96180f89e728e21b21945205c1944013

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  2541fb0a24ad9c6e350d4af99483bc8a.exe
- Size
  
  318KB
- MD5
  
  2541fb0a24ad9c6e350d4af99483bc8a
- SHA1
  
  a7d5b41f0ff33e6fff4d9702fc41799124a8a99a
- SHA256
  
  730a70d818d2744c00405b1829f364d997bf94b4f5b817fa49edc39c650ef2df
- SHA512
  
  05ad08af00eddd6a04536f093c470ed0cd2ec0c3beb22117f0a08fccbef2ba8a9acdda0b70b8aa97ce807a03279077aa96180f89e728e21b21945205c1944013
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan

behavioral2

smokeloaderbackdoortrojan