smokeloader | 7fb3b392ec05044f72de18860c47d66fb878bfeb3b297f5981b4c6ac085d9ff1 | Triage

Sharing

General

Target

7fb3b392ec05044f72de18860c47d66fb878bfeb3b297f5981b4c6ac085d9ff1
Size

332KB
Sample

220126-qfaq1adafn
MD5

8bbf90c66d185ad1f0b3724eb8197e50
SHA1

6a86a458530feb14ee5314c233fbd75bdc269689
SHA256

7fb3b392ec05044f72de18860c47d66fb878bfeb3b297f5981b4c6ac085d9ff1
SHA512

159351420edfec6b69914b26935a7df2416d6597ea77218125371f9b3dd2af83f072e96b2bd2cbcb97e793d3c473c806a20574f98663700ba68d2388cf14882f

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  7fb3b392ec05044f72de18860c47d66fb878bfeb3b297f5981b4c6ac085d9ff1
- Size
  
  332KB
- MD5
  
  8bbf90c66d185ad1f0b3724eb8197e50
- SHA1
  
  6a86a458530feb14ee5314c233fbd75bdc269689
- SHA256
  
  7fb3b392ec05044f72de18860c47d66fb878bfeb3b297f5981b4c6ac085d9ff1
- SHA512
  
  159351420edfec6b69914b26935a7df2416d6597ea77218125371f9b3dd2af83f072e96b2bd2cbcb97e793d3c473c806a20574f98663700ba68d2388cf14882f
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan