smokeloader | d7ebe8736ffb8f8823ffb16816438facd6a58ac30d3e9915287d35835d22d8a3 | Triage

Sharing

General

Target

d7ebe8736ffb8f8823ffb16816438facd6a58ac30d3e9915287d35835d22d8a3
Size

333KB
Sample

220126-fp3g9sgfer
MD5

a77eca3994e446f98ac943976d7d2a51
SHA1

f3e9947605bd6452dfa3c9b8c4417953f24cec0c
SHA256

d7ebe8736ffb8f8823ffb16816438facd6a58ac30d3e9915287d35835d22d8a3
SHA512

465d3a2667fa68f3a767d41f61d3996868a2a2dcd92cd931c77c705cc29ef0f891e24fe80c2b7aa8eb576ec09062000f3ace0e188f71f9f0525f47a4f5f9820e

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  d7ebe8736ffb8f8823ffb16816438facd6a58ac30d3e9915287d35835d22d8a3
- Size
  
  333KB
- MD5
  
  a77eca3994e446f98ac943976d7d2a51
- SHA1
  
  f3e9947605bd6452dfa3c9b8c4417953f24cec0c
- SHA256
  
  d7ebe8736ffb8f8823ffb16816438facd6a58ac30d3e9915287d35835d22d8a3
- SHA512
  
  465d3a2667fa68f3a767d41f61d3996868a2a2dcd92cd931c77c705cc29ef0f891e24fe80c2b7aa8eb576ec09062000f3ace0e188f71f9f0525f47a4f5f9820e
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan