smokeloader | e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7 | Triage

Sharing

General

Target

e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7
Size

352KB
Sample

220128-qzm6faeag2
MD5

bd47c8d154580c006584c167678e80a0
SHA1

874eda0e9a278ca597523e013e802142eab6dc1d
SHA256

e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7
SHA512

d696f94d7b31aedc752b67818a3bce4fc6d1b6752560408a0ad17a34f16ef4140d8b4e3847e7ba1ba29ff024416253b33ed034a56cea1eace4111e6ea1b34a1f

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Targets

- Target
  
  e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7
- Size
  
  352KB
- MD5
  
  bd47c8d154580c006584c167678e80a0
- SHA1
  
  874eda0e9a278ca597523e013e802142eab6dc1d
- SHA256
  
  e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7
- SHA512
  
  d696f94d7b31aedc752b67818a3bce4fc6d1b6752560408a0ad17a34f16ef4140d8b4e3847e7ba1ba29ff024416253b33ed034a56cea1eace4111e6ea1b34a1f
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan