smokeloader | 0bb8d0041789cf7f981d778b8da162c58b304f9fa2b5e761fe81389a530d2ba9 | Triage

Sharing

General

Target

0bb8d0041789cf7f981d778b8da162c58b304f9fa2b5e761fe81389a530d2ba9
Size

334KB
Sample

220126-ybbrhahhc4
MD5

df0895c1dd3ffab04aba5ce65209e853
SHA1

0c08794921a772d8813bf312d0766923ab3a6f8b
SHA256

0bb8d0041789cf7f981d778b8da162c58b304f9fa2b5e761fe81389a530d2ba9
SHA512

6e5e56c2c916c6a0d87db9affe708322aecf5c53c3e23fa9f56404d70b530e9b45b9d85cc76b14579930e789ad808b88c5f0dd171d879093ec19485eaf0e5187

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  0bb8d0041789cf7f981d778b8da162c58b304f9fa2b5e761fe81389a530d2ba9
- Size
  
  334KB
- MD5
  
  df0895c1dd3ffab04aba5ce65209e853
- SHA1
  
  0c08794921a772d8813bf312d0766923ab3a6f8b
- SHA256
  
  0bb8d0041789cf7f981d778b8da162c58b304f9fa2b5e761fe81389a530d2ba9
- SHA512
  
  6e5e56c2c916c6a0d87db9affe708322aecf5c53c3e23fa9f56404d70b530e9b45b9d85cc76b14579930e789ad808b88c5f0dd171d879093ec19485eaf0e5187
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan