smokeloader | cc621323e57e22e483517f633fb4f9248220a0cd8a69cd0674ade45ffcdd6ce3 | Triage

Sharing

General

Target

cc621323e57e22e483517f633fb4f9248220a0cd8a69cd0674ade45ffcdd6ce3
Size

330KB
Sample

230319-cl6hzaee38
MD5

6e79eebefe0bfae39c06ce88ff06958d
SHA1

120c4bbd53ddceb8308e847cb4983738af295c96
SHA256

cc621323e57e22e483517f633fb4f9248220a0cd8a69cd0674ade45ffcdd6ce3
SHA512

c1771c5d5497936614e971380a0de92a1fecd2df2b227168ce942e3e541aa26a3ec26a2ce0bfee58c89e55c50aefb743b4f9189a95856028fa18a1370c40d2c2
SSDEEP

3072:32vlMNE1iLueiV8MIsPuUuNjI7xd7Xp8OQXJr8wjC1+2DsYRVwtMESH:mvEE1iLliVFPC5I7rXpPIzC1rNESH

Score

10^/10

smokeloader lab backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

lab

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  cc621323e57e22e483517f633fb4f9248220a0cd8a69cd0674ade45ffcdd6ce3
- Size
  
  330KB
- MD5
  
  6e79eebefe0bfae39c06ce88ff06958d
- SHA1
  
  120c4bbd53ddceb8308e847cb4983738af295c96
- SHA256
  
  cc621323e57e22e483517f633fb4f9248220a0cd8a69cd0674ade45ffcdd6ce3
- SHA512
  
  c1771c5d5497936614e971380a0de92a1fecd2df2b227168ce942e3e541aa26a3ec26a2ce0bfee58c89e55c50aefb743b4f9189a95856028fa18a1370c40d2c2
- SSDEEP
  
  3072:32vlMNE1iLueiV8MIsPuUuNjI7xd7Xp8OQXJr8wjC1+2DsYRVwtMESH:mvEE1iLliVFPC5I7rXpPIzC1rNESH
Score

10^/10

smokeloader lab backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

smokeloaderlabbackdoortrojan