smokeloader | c0cd67b8d13f4e78bc7f28097ea8cc34fceadc07a0e627b355a2315b169373cb | Triage

Sharing

General

Target

c0cd67b8d13f4e78bc7f28097ea8cc34fceadc07a0e627b355a2315b169373cb
Size

333KB
Sample

220126-h15swaaceq
MD5

f27d49c64240bc5941a5fd0d5fd931a0
SHA1

0e0d5405237d01eac47742193ba66a2eedd0ccd3
SHA256

c0cd67b8d13f4e78bc7f28097ea8cc34fceadc07a0e627b355a2315b169373cb
SHA512

3fd9a9f95ce39c5ffaf9741663f16a205ef33221d00d04256e7524cf63fa20a2d46fc3e60b16a282c5a7cbee07636f8027e17b8e001a5c62c02860051d642e8e

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  c0cd67b8d13f4e78bc7f28097ea8cc34fceadc07a0e627b355a2315b169373cb
- Size
  
  333KB
- MD5
  
  f27d49c64240bc5941a5fd0d5fd931a0
- SHA1
  
  0e0d5405237d01eac47742193ba66a2eedd0ccd3
- SHA256
  
  c0cd67b8d13f4e78bc7f28097ea8cc34fceadc07a0e627b355a2315b169373cb
- SHA512
  
  3fd9a9f95ce39c5ffaf9741663f16a205ef33221d00d04256e7524cf63fa20a2d46fc3e60b16a282c5a7cbee07636f8027e17b8e001a5c62c02860051d642e8e
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan