smokeloader | 4d463a86538863cb425e7edf7ccfeac12f1abbd728b3f499408d09c6abf210ff | Triage

Sharing

General

Target

4d463a86538863cb425e7edf7ccfeac12f1abbd728b3f499408d09c6abf210ff
Size

241KB
Sample

220127-jp5t6shegr
MD5

b2e39037722559ca16abbf296adb276a
SHA1

2269b753c5a938cb1a33a7bd160a52e80d4bb43c
SHA256

4d463a86538863cb425e7edf7ccfeac12f1abbd728b3f499408d09c6abf210ff
SHA512

7ed20f873fde16393ef3e8d6a73c7e67754027b3ae3655aa3eb5fbd5215c6f08965be7680e2194a9298d4aadde519e9535a6b789dab2787a70bbe8c55e1a491b

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  4d463a86538863cb425e7edf7ccfeac12f1abbd728b3f499408d09c6abf210ff
- Size
  
  241KB
- MD5
  
  b2e39037722559ca16abbf296adb276a
- SHA1
  
  2269b753c5a938cb1a33a7bd160a52e80d4bb43c
- SHA256
  
  4d463a86538863cb425e7edf7ccfeac12f1abbd728b3f499408d09c6abf210ff
- SHA512
  
  7ed20f873fde16393ef3e8d6a73c7e67754027b3ae3655aa3eb5fbd5215c6f08965be7680e2194a9298d4aadde519e9535a6b789dab2787a70bbe8c55e1a491b
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan