smokeloader | 40bd2aafaaf6619b5711338e6c88fe161ca690a0bc6421c48ec38f6ed11aef54 | Triage

Sharing

General

Target

40bd2aafaaf6619b5711338e6c88fe161ca690a0bc6421c48ec38f6ed11aef54
Size

334KB
Sample

220126-hxcb6aaed7
MD5

cb87fd15d0d0b46696341d974ebe62d6
SHA1

d68fa4f43246c137b565366f6e8b7f08e768f06f
SHA256

40bd2aafaaf6619b5711338e6c88fe161ca690a0bc6421c48ec38f6ed11aef54
SHA512

852d1174ea56c65be54ff938c867cc2f37977f59a85b2bc6e00096e0e8043b9f32f64245c847a297da78529625f2b5d6d0857f857e6a3ca57605a3c98a7a7af4

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  40bd2aafaaf6619b5711338e6c88fe161ca690a0bc6421c48ec38f6ed11aef54
- Size
  
  334KB
- MD5
  
  cb87fd15d0d0b46696341d974ebe62d6
- SHA1
  
  d68fa4f43246c137b565366f6e8b7f08e768f06f
- SHA256
  
  40bd2aafaaf6619b5711338e6c88fe161ca690a0bc6421c48ec38f6ed11aef54
- SHA512
  
  852d1174ea56c65be54ff938c867cc2f37977f59a85b2bc6e00096e0e8043b9f32f64245c847a297da78529625f2b5d6d0857f857e6a3ca57605a3c98a7a7af4
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan