smokeloader | 6ff62169824c40354932fd738f8ef29389486bdbd62ff2e277a65cad7b6cbf17 | Triage

Sharing

General

Target

6ff62169824c40354932fd738f8ef29389486bdbd62ff2e277a65cad7b6cbf17
Size

317KB
Sample

220125-zqdp3sfac9
MD5

7b2b9f625b16b277c67f5b567aa47b13
SHA1

cc66eaa9615e3eb1c3726bcb693557ad17b3eedc
SHA256

6ff62169824c40354932fd738f8ef29389486bdbd62ff2e277a65cad7b6cbf17
SHA512

88aa5ee7cef3d905aa9f4c22f7864e6c3622d627a6c526ff01e48fe8f2e0cccce92a060520bf17cfc163e72cc81bd16fb07039417354d954bc3c7f9cf364106c

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://abpa.at/upload/

http://emaratghajari.com/upload/

http://d7qw.cn/upload/

http://alumik-group.ru/upload/

http://zamkikurgan.ru/upload/

rc4.i32

rc4.i32

Targets

- Target
  
  6ff62169824c40354932fd738f8ef29389486bdbd62ff2e277a65cad7b6cbf17
- Size
  
  317KB
- MD5
  
  7b2b9f625b16b277c67f5b567aa47b13
- SHA1
  
  cc66eaa9615e3eb1c3726bcb693557ad17b3eedc
- SHA256
  
  6ff62169824c40354932fd738f8ef29389486bdbd62ff2e277a65cad7b6cbf17
- SHA512
  
  88aa5ee7cef3d905aa9f4c22f7864e6c3622d627a6c526ff01e48fe8f2e0cccce92a060520bf17cfc163e72cc81bd16fb07039417354d954bc3c7f9cf364106c
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan