smokeloader | 104f89105ef08c142b992dcc9915d4e0284529bfb6f07f522bd0d805800e690b | Triage

Sharing

General

Target

104f89105ef08c142b992dcc9915d4e0284529bfb6f07f522bd0d805800e690b
Size

333KB
Sample

220126-azsg6aahbl
MD5

8a22d0c2ca9db6d58495bb87df521949
SHA1

294e946b60efc3ed1283e6aa576906e833abc0c3
SHA256

104f89105ef08c142b992dcc9915d4e0284529bfb6f07f522bd0d805800e690b
SHA512

cccc593cbb92f3cd1055825d50012368f406bfeb19d9a4ce566999ef09518d728adfb0aed12047e3b376a47058d9afdea126a09fcc70ab022ed50c7e3f6518c6

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  104f89105ef08c142b992dcc9915d4e0284529bfb6f07f522bd0d805800e690b
- Size
  
  333KB
- MD5
  
  8a22d0c2ca9db6d58495bb87df521949
- SHA1
  
  294e946b60efc3ed1283e6aa576906e833abc0c3
- SHA256
  
  104f89105ef08c142b992dcc9915d4e0284529bfb6f07f522bd0d805800e690b
- SHA512
  
  cccc593cbb92f3cd1055825d50012368f406bfeb19d9a4ce566999ef09518d728adfb0aed12047e3b376a47058d9afdea126a09fcc70ab022ed50c7e3f6518c6
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan