smokeloader | bebc89ca5001eeea01dd9f2166c7e9c190322a7745d255eb7ca5e61fc936aa18 | Triage

Sharing

General

Target

bebc89ca5001eeea01dd9f2166c7e9c190322a7745d255eb7ca5e61fc936aa18
Size

604KB
Sample

220708-hyetnsgfa9
MD5

f051bf2612c1aed5cae44387940e87e4
SHA1

6d0aa242124665f72ec6ff30dcde9abda9c863ef
SHA256

bebc89ca5001eeea01dd9f2166c7e9c190322a7745d255eb7ca5e61fc936aa18
SHA512

a24558b94d313fe302e81c47d1280aaedb7fb247de8d736a9e1f375dc053df36aa5308177e628d9a0bc96924511a1825942f9e652cc72492b91765dc354a1750

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2019

C2

https://edwardsjayden.pw/

https://mathewbutler.pw/

https://aidencoleman.pw/

rc4.i32

rc4.i32

Targets

- Target
  
  bebc89ca5001eeea01dd9f2166c7e9c190322a7745d255eb7ca5e61fc936aa18
- Size
  
  604KB
- MD5
  
  f051bf2612c1aed5cae44387940e87e4
- SHA1
  
  6d0aa242124665f72ec6ff30dcde9abda9c863ef
- SHA256
  
  bebc89ca5001eeea01dd9f2166c7e9c190322a7745d255eb7ca5e61fc936aa18
- SHA512
  
  a24558b94d313fe302e81c47d1280aaedb7fb247de8d736a9e1f375dc053df36aa5308177e628d9a0bc96924511a1825942f9e652cc72492b91765dc354a1750
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan

behavioral2

smokeloaderbackdoortrojan