smokeloader | e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902 | Triage

Sharing

General

Target

e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902
Size

317KB
Sample

220125-ytx3fsdhcq
MD5

a21c8d80fb1a92c97c92b4e9dbb55157
SHA1

22aabf615fac867c3b51b5e71df1f3cc24a88cf1
SHA256

e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902
SHA512

f489064bfdec5980f621f90aa6fcd235db51a2acf691588247ad3bc069e0959c05594ff7363aff0050a488b4e31d58e569fc80668f25310a9e371fbd25e8887b

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902
- Size
  
  317KB
- MD5
  
  a21c8d80fb1a92c97c92b4e9dbb55157
- SHA1
  
  22aabf615fac867c3b51b5e71df1f3cc24a88cf1
- SHA256
  
  e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902
- SHA512
  
  f489064bfdec5980f621f90aa6fcd235db51a2acf691588247ad3bc069e0959c05594ff7363aff0050a488b4e31d58e569fc80668f25310a9e371fbd25e8887b
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan