smokeloader | 9ac0480c0f404bb5bd7becd2ed3c6ecba0aeabcd9c4c189403ca5ccc323f668c | Triage

Sharing

General

Target

9ac0480c0f404bb5bd7becd2ed3c6ecba0aeabcd9c4c189403ca5ccc323f668c
Size

357KB
Sample

220128-ehvneafgf4
MD5

86a99cf893b1cece793e21b9a4a80e3f
SHA1

d74b085187cb2b21e6c3a18a9b25cbbe29b0fbdc
SHA256

9ac0480c0f404bb5bd7becd2ed3c6ecba0aeabcd9c4c189403ca5ccc323f668c
SHA512

4cd07d606d114bdf25f4428b20c54445c8b4e7c129a736cda2847b0ebccd5086bf434a6dbf852af969585de2c3c172bf1d8f14949df52a6260e82a9fa50f7d46

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  9ac0480c0f404bb5bd7becd2ed3c6ecba0aeabcd9c4c189403ca5ccc323f668c
- Size
  
  357KB
- MD5
  
  86a99cf893b1cece793e21b9a4a80e3f
- SHA1
  
  d74b085187cb2b21e6c3a18a9b25cbbe29b0fbdc
- SHA256
  
  9ac0480c0f404bb5bd7becd2ed3c6ecba0aeabcd9c4c189403ca5ccc323f668c
- SHA512
  
  4cd07d606d114bdf25f4428b20c54445c8b4e7c129a736cda2847b0ebccd5086bf434a6dbf852af969585de2c3c172bf1d8f14949df52a6260e82a9fa50f7d46
Score

10^/10

smokeloader backdoor persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan