smokeloader | 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11 | Triage

Sharing

General

Target

798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11
Size

240KB
Sample

220127-faxy8sgad2
MD5

49f0abdf9938b07ee4d8ef39c88a6619
SHA1

18d9b0bc5b27b048302baf0ef362dd896843970c
SHA256

798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11
SHA512

2905a695f52e8ffa8b33ad5c4ba2d5d6ba6caea13f92eb1983d1a6092b36a1dcf6f50b724101e6c02a1b6b9a454622796f048a10a96d94cbc3f54a71ad7c2d4c

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11
- Size
  
  240KB
- MD5
  
  49f0abdf9938b07ee4d8ef39c88a6619
- SHA1
  
  18d9b0bc5b27b048302baf0ef362dd896843970c
- SHA256
  
  798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11
- SHA512
  
  2905a695f52e8ffa8b33ad5c4ba2d5d6ba6caea13f92eb1983d1a6092b36a1dcf6f50b724101e6c02a1b6b9a454622796f048a10a96d94cbc3f54a71ad7c2d4c
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan