smokeloader | 6fc6cf563b360eb1837a208ea37ef96f5634209d1a215376d91b1d1260bdb15b | Triage

Sharing

General

Target

6fc6cf563b360eb1837a208ea37ef96f5634209d1a215376d91b1d1260bdb15b
Size

317KB
Sample

220125-ypys7aebg5
MD5

0bd4cdbc2a08fcb8c7209da218c097b0
SHA1

82835ff8c927aa0c4637b3589fd62128954d1d67
SHA256

6fc6cf563b360eb1837a208ea37ef96f5634209d1a215376d91b1d1260bdb15b
SHA512

aa96eefc3d740e918617c2144f5ba3764a140e365266130da9efc96fe6fc15f4ea2fe8aa3573ecec2f6cdb53f8b69226e7e53d40e871b5c505df21a73b0a657c

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  6fc6cf563b360eb1837a208ea37ef96f5634209d1a215376d91b1d1260bdb15b
- Size
  
  317KB
- MD5
  
  0bd4cdbc2a08fcb8c7209da218c097b0
- SHA1
  
  82835ff8c927aa0c4637b3589fd62128954d1d67
- SHA256
  
  6fc6cf563b360eb1837a208ea37ef96f5634209d1a215376d91b1d1260bdb15b
- SHA512
  
  aa96eefc3d740e918617c2144f5ba3764a140e365266130da9efc96fe6fc15f4ea2fe8aa3573ecec2f6cdb53f8b69226e7e53d40e871b5c505df21a73b0a657c
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan