smokeloader | 30992bd7993a1f698c11d69c5c3e7cf440268cb32e51318e29142f12bd550981 | Triage

Sharing

General

Target

30992bd7993a1f698c11d69c5c3e7cf440268cb32e51318e29142f12bd550981
Size

190KB
Sample

220127-weld1ahcc9
MD5

fc984dab945855a82bd58a4f2b8e6d94
SHA1

b06fd09f7a32c7cd8baf7e291a01d384eafd7542
SHA256

30992bd7993a1f698c11d69c5c3e7cf440268cb32e51318e29142f12bd550981
SHA512

f237e8de58c341648b8da2ff9483fa893d39592d079f8b702a3c42bfbf06676b3b93e9d0cf65f1b990910c6386a76e2bd22a56306fd473e3c082a9781f9634c3

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  30992bd7993a1f698c11d69c5c3e7cf440268cb32e51318e29142f12bd550981
- Size
  
  190KB
- MD5
  
  fc984dab945855a82bd58a4f2b8e6d94
- SHA1
  
  b06fd09f7a32c7cd8baf7e291a01d384eafd7542
- SHA256
  
  30992bd7993a1f698c11d69c5c3e7cf440268cb32e51318e29142f12bd550981
- SHA512
  
  f237e8de58c341648b8da2ff9483fa893d39592d079f8b702a3c42bfbf06676b3b93e9d0cf65f1b990910c6386a76e2bd22a56306fd473e3c082a9781f9634c3
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan