smokeloader | 4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428 | Triage

Sharing

General

Target

4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428
Size

234KB
Sample

220125-pgewnsffap
MD5

cc5f35947be6d112c2f8625b30fecb2a
SHA1

98cc827e5347513a7a1f5f65ff9217c28ce1bccb
SHA256

4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428
SHA512

6ed0966d9c86f73751965b6a198fc59ecdbf218ee231d40b9c9e7f5b73d0db1d72091bfafcf896bc034042e801303ecca8aad7689274f2802f611ca6eaff5992

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

https://olobus.casa/feedback.php

https://trusho.online/feedback.php

rc4.i32

rc4.i32

Targets

- Target
  
  4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428
- Size
  
  234KB
- MD5
  
  cc5f35947be6d112c2f8625b30fecb2a
- SHA1
  
  98cc827e5347513a7a1f5f65ff9217c28ce1bccb
- SHA256
  
  4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428
- SHA512
  
  6ed0966d9c86f73751965b6a198fc59ecdbf218ee231d40b9c9e7f5b73d0db1d72091bfafcf896bc034042e801303ecca8aad7689274f2802f611ca6eaff5992
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan

behavioral2

smokeloaderbackdoortrojan