smokeloader | 9f19531f8fd468d2e6624a17644bb5508e3522b7454f04cb804c304eff5efd28 | Triage

Sharing

General

Target

9f19531f8fd468d2e6624a17644bb5508e3522b7454f04cb804c304eff5efd28
Size

190KB
Sample

220127-z1s8hsaegq
MD5

0dc9184adf3cab7aa0b275f37f4d3152
SHA1

4899831adf6b28eda04e16d5c084445228436b8c
SHA256

9f19531f8fd468d2e6624a17644bb5508e3522b7454f04cb804c304eff5efd28
SHA512

21f7d9678efeed9af7d3adc558a6842c9c7867cc08205c290327ab4eded792b39ea200e7f39b8735f972ff88f1ba0201cbd1f990bb4d8ae0f4935daca456d1c7

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  9f19531f8fd468d2e6624a17644bb5508e3522b7454f04cb804c304eff5efd28
- Size
  
  190KB
- MD5
  
  0dc9184adf3cab7aa0b275f37f4d3152
- SHA1
  
  4899831adf6b28eda04e16d5c084445228436b8c
- SHA256
  
  9f19531f8fd468d2e6624a17644bb5508e3522b7454f04cb804c304eff5efd28
- SHA512
  
  21f7d9678efeed9af7d3adc558a6842c9c7867cc08205c290327ab4eded792b39ea200e7f39b8735f972ff88f1ba0201cbd1f990bb4d8ae0f4935daca456d1c7
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan