smokeloader | bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7 | Triage

Sharing

General

Target

bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7
Size

356KB
Sample

220128-hdphdagfbj
MD5

e3d296124f2da2201fb37de049efc63e
SHA1

87488ab791ca1e0a18258551b7c4ac0c7a182e07
SHA256

bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7
SHA512

696836f7a79022ac191ca19a1ef759949bbeb51ba269bde59ed722d353828ca3f929c521eb1954e583098956736f0e588fa9e4c6e32b1b22966c735319de6ddc

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7
- Size
  
  356KB
- MD5
  
  e3d296124f2da2201fb37de049efc63e
- SHA1
  
  87488ab791ca1e0a18258551b7c4ac0c7a182e07
- SHA256
  
  bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7
- SHA512
  
  696836f7a79022ac191ca19a1ef759949bbeb51ba269bde59ed722d353828ca3f929c521eb1954e583098956736f0e588fa9e4c6e32b1b22966c735319de6ddc
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan