smokeloader | 61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91 | Triage

Sharing

General

Target

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91
Size

317KB
Sample

220125-samjqahfc7
MD5

827657a25805cd47b4d8c3fc04f3605c
SHA1

9813e4e80ca00667706dad344985a5d45513d627
SHA256

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91
SHA512

c0e5292ea34de1a99122cd66a6cd268137b67cb81dbdf439c60d7d42caae1402f8bd93729011929566ddddc5bb76c1dca8d77fa248091dc499791a8d4cf376dc

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91
- Size
  
  317KB
- MD5
  
  827657a25805cd47b4d8c3fc04f3605c
- SHA1
  
  9813e4e80ca00667706dad344985a5d45513d627
- SHA256
  
  61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91
- SHA512
  
  c0e5292ea34de1a99122cd66a6cd268137b67cb81dbdf439c60d7d42caae1402f8bd93729011929566ddddc5bb76c1dca8d77fa248091dc499791a8d4cf376dc
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan