smokeloader | 70edf7430c4bcd538b605b18713643a93e62102afb98c1ea0484ce638691160e | Triage

Sharing

General

Target

70edf7430c4bcd538b605b18713643a93e62102afb98c1ea0484ce638691160e
Size

333KB
Sample

220126-trytraffc8
MD5

9d79ae09594711aa6ac7d7bee806302b
SHA1

f2584ef0d6a9bc2281455002ba43383297ab1ccd
SHA256

70edf7430c4bcd538b605b18713643a93e62102afb98c1ea0484ce638691160e
SHA512

6729a92ff8ecda05bfe52cbfd7e6edaa375ba7f78f0c4f3f2eefe55186e0f6c2beaabe49d44ed8bad123a5da6bf78502cd733d071e8daf657de15e22343564fe

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  70edf7430c4bcd538b605b18713643a93e62102afb98c1ea0484ce638691160e
- Size
  
  333KB
- MD5
  
  9d79ae09594711aa6ac7d7bee806302b
- SHA1
  
  f2584ef0d6a9bc2281455002ba43383297ab1ccd
- SHA256
  
  70edf7430c4bcd538b605b18713643a93e62102afb98c1ea0484ce638691160e
- SHA512
  
  6729a92ff8ecda05bfe52cbfd7e6edaa375ba7f78f0c4f3f2eefe55186e0f6c2beaabe49d44ed8bad123a5da6bf78502cd733d071e8daf657de15e22343564fe
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan