smokeloader | d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070 | Triage

Sharing

General

Target

d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070
Size

190KB
Sample

220127-zvlw9aaeaj
MD5

ee419e8bb27ea365a290d3c9e3c33e74
SHA1

492681db5de609d5e25680500d73ddac84bce1a9
SHA256

d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070
SHA512

cff89fb444c31aece2755d5edf47f7d478318ce7cdac039902b6b3b289a9e58c0401561d889a6d1d3bff104e204b191398e62af6c14355c8108a5e06402840dd

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070
- Size
  
  190KB
- MD5
  
  ee419e8bb27ea365a290d3c9e3c33e74
- SHA1
  
  492681db5de609d5e25680500d73ddac84bce1a9
- SHA256
  
  d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070
- SHA512
  
  cff89fb444c31aece2755d5edf47f7d478318ce7cdac039902b6b3b289a9e58c0401561d889a6d1d3bff104e204b191398e62af6c14355c8108a5e06402840dd
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan