smokeloader | ecd4c889163fd386f6e9e96423c1a66d0427da57d5410bd6bc0bcd68dc0fcca1 | Triage

Sharing

General

Target

setup.exe
Size

223KB
Sample

230329-byjdjafh9w
MD5

59123acddd545054b3385d8ead1c6cb9
SHA1

2106827335c1b4fcb3d58e7c4eef40d767102511
SHA256

ecd4c889163fd386f6e9e96423c1a66d0427da57d5410bd6bc0bcd68dc0fcca1
SHA512

f77c8cdfa3f73604105ac53fbff6a8f9da0a7f955937cff1a855f57e13e72abf7824f3fb821e5d72ae85690834318a242c568b4ea6aeb7cf79831b252aafea4c
SSDEEP

3072:4591nCMyxJ5hwDGQs7Mi+ic0orjiFcBT6SRUOV9O0yaEY:sHtoA8yI2T6m8

Score

10^/10

smokeloader lab backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

lab

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  setup.exe
- Size
  
  223KB
- MD5
  
  59123acddd545054b3385d8ead1c6cb9
- SHA1
  
  2106827335c1b4fcb3d58e7c4eef40d767102511
- SHA256
  
  ecd4c889163fd386f6e9e96423c1a66d0427da57d5410bd6bc0bcd68dc0fcca1
- SHA512
  
  f77c8cdfa3f73604105ac53fbff6a8f9da0a7f955937cff1a855f57e13e72abf7824f3fb821e5d72ae85690834318a242c568b4ea6aeb7cf79831b252aafea4c
- SSDEEP
  
  3072:4591nCMyxJ5hwDGQs7Mi+ic0orjiFcBT6SRUOV9O0yaEY:sHtoA8yI2T6m8
Score

10^/10

smokeloader lab backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderlabbackdoortrojan

behavioral2

smokeloaderlabbackdoortrojan