smokeloader | 7f9071889621ee9d20e929c3ee97ac480cc781bf0c1da65f955f6ccf2ab11015 | Triage

Sharing

General

Target

7f9071889621ee9d20e929c3ee97ac480cc781bf0c1da65f955f6ccf2ab11015
Size

334KB
Sample

220126-tx4besfbdm
MD5

59067269ff1f9184daff26b888c2099e
SHA1

560a10537048600d5802aad558da3231233ded30
SHA256

7f9071889621ee9d20e929c3ee97ac480cc781bf0c1da65f955f6ccf2ab11015
SHA512

1a04b117b8cd2059e52e214ddad776699ca1853e1e36da9f14e6e3f04677be3d24581763e85e5643a794435df87a63d14d6a8856a2a6a08c31f21f012be5cf1d

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  7f9071889621ee9d20e929c3ee97ac480cc781bf0c1da65f955f6ccf2ab11015
- Size
  
  334KB
- MD5
  
  59067269ff1f9184daff26b888c2099e
- SHA1
  
  560a10537048600d5802aad558da3231233ded30
- SHA256
  
  7f9071889621ee9d20e929c3ee97ac480cc781bf0c1da65f955f6ccf2ab11015
- SHA512
  
  1a04b117b8cd2059e52e214ddad776699ca1853e1e36da9f14e6e3f04677be3d24581763e85e5643a794435df87a63d14d6a8856a2a6a08c31f21f012be5cf1d
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan