smokeloader | 9c19e311cc6783bf94c29454ab5c9418af23d200d6c6ede34581f55abb19beda | Triage

Sharing

General

Target

9c19e311cc6783bf94c29454ab5c9418af23d200d6c6ede34581f55abb19beda
Size

241KB
Sample

220127-ey5tbafdbj
MD5

b56c4727a3bf9de8385332fdd14c4b9b
SHA1

f1c0b1537f068ede8f84e3d9474540d960a4adb9
SHA256

9c19e311cc6783bf94c29454ab5c9418af23d200d6c6ede34581f55abb19beda
SHA512

dcc4eb8d7aabc1499ad731e65dad9fe665b1f8e5732eabe5fe649ed227e6535867fb2b9b886c1f353fa524bfbd8f7110e69f15ada2044d558ac5fbd0c3dcb26f

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  9c19e311cc6783bf94c29454ab5c9418af23d200d6c6ede34581f55abb19beda
- Size
  
  241KB
- MD5
  
  b56c4727a3bf9de8385332fdd14c4b9b
- SHA1
  
  f1c0b1537f068ede8f84e3d9474540d960a4adb9
- SHA256
  
  9c19e311cc6783bf94c29454ab5c9418af23d200d6c6ede34581f55abb19beda
- SHA512
  
  dcc4eb8d7aabc1499ad731e65dad9fe665b1f8e5732eabe5fe649ed227e6535867fb2b9b886c1f353fa524bfbd8f7110e69f15ada2044d558ac5fbd0c3dcb26f
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan