smokeloader | b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6 | Triage

Sharing

General

Target

b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6
Size

241KB
Sample

220127-k7vmlaadaq
MD5

3e0b102e4d7aa343f22722dcfd45b1db
SHA1

82e1feb7d38edc7acf37f82f81ac097910273855
SHA256

b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6
SHA512

e6c6d453365f0ad99d1314e9d7da63dd76f67bac40ed0f4fe132a273ad7899f8c15d8e790767260aa0aacdbc01d03bc784e826c799f87dcd40030fff291acbb6

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6
- Size
  
  241KB
- MD5
  
  3e0b102e4d7aa343f22722dcfd45b1db
- SHA1
  
  82e1feb7d38edc7acf37f82f81ac097910273855
- SHA256
  
  b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6
- SHA512
  
  e6c6d453365f0ad99d1314e9d7da63dd76f67bac40ed0f4fe132a273ad7899f8c15d8e790767260aa0aacdbc01d03bc784e826c799f87dcd40030fff291acbb6
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan