smokeloader | 8c4db554f06d0a7faa5edddb9b36cb184ca9e0d3bc2c0bd77ebfc5ed4befeb18 | Triage

Sharing

General

Target

8c4db554f06d0a7faa5edddb9b36cb184ca9e0d3bc2c0bd77ebfc5ed4befeb18
Size

317KB
Sample

220125-rja2lsghak
MD5

fd3d07d95fde1e67f6e3f28739003e99
SHA1

b00dc2b3e9519f877a5e6b51feebd421309dcd1f
SHA256

8c4db554f06d0a7faa5edddb9b36cb184ca9e0d3bc2c0bd77ebfc5ed4befeb18
SHA512

8226987e95899729721e23f05ad149f0031f2098f1f29a78a6b09a160c87550f9d7bfc0cb8531a211923767e0a4e8dea0b4a6887611c4658447f547782adef8c

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  8c4db554f06d0a7faa5edddb9b36cb184ca9e0d3bc2c0bd77ebfc5ed4befeb18
- Size
  
  317KB
- MD5
  
  fd3d07d95fde1e67f6e3f28739003e99
- SHA1
  
  b00dc2b3e9519f877a5e6b51feebd421309dcd1f
- SHA256
  
  8c4db554f06d0a7faa5edddb9b36cb184ca9e0d3bc2c0bd77ebfc5ed4befeb18
- SHA512
  
  8226987e95899729721e23f05ad149f0031f2098f1f29a78a6b09a160c87550f9d7bfc0cb8531a211923767e0a4e8dea0b4a6887611c4658447f547782adef8c
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan