smokeloader | 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1 | Triage

Sharing

General

Target

88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1
Size

356KB
Sample

220128-beh9esddeq
MD5

22eb12e34b7fe6eb3cbf8a0af69c05f9
SHA1

c6b4278662291d0c8077b87e493e1fd1c34c129a
SHA256

88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1
SHA512

f71698cad8a6207a5d54d5d97f90f36449097ce32fae607e3b7d1a470886afea420a265ab380305cabc997fe80ef202d39c188be85b68340c671056f83f06685

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1
- Size
  
  356KB
- MD5
  
  22eb12e34b7fe6eb3cbf8a0af69c05f9
- SHA1
  
  c6b4278662291d0c8077b87e493e1fd1c34c129a
- SHA256
  
  88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1
- SHA512
  
  f71698cad8a6207a5d54d5d97f90f36449097ce32fae607e3b7d1a470886afea420a265ab380305cabc997fe80ef202d39c188be85b68340c671056f83f06685
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan