smokeloader | 6057bf9ebf7eea574188df68f68f8cc94171ab84f9f56bec6d5561648bf219f4 | Triage

Sharing

General

Target

6057bf9ebf7eea574188df68f68f8cc94171ab84f9f56bec6d5561648bf219f4
Size

352KB
Sample

230415-npxk1sfe2s
MD5

1e4df02f3f4ce624cb038d5198d53b56
SHA1

466d307b640c1b34ddacd1cf3eae008985ebaf84
SHA256

6057bf9ebf7eea574188df68f68f8cc94171ab84f9f56bec6d5561648bf219f4
SHA512

f8fb04d0505757b46d4e4670c3d9b862305db2abf9de5f8352a57b542af5ffef0fb6657d0b7ebdaaba60fc79a85b79c14c5db892b54adaeac04247383e5978a8
SSDEEP

6144:sV2GCVehspwDhxSrysgO43fmp0G8a6sQPXKwe4:swLehspw1xSrysAc0G8a6sAXKt4

Score

10^/10

smokeloader pu10 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pu10

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  6057bf9ebf7eea574188df68f68f8cc94171ab84f9f56bec6d5561648bf219f4
- Size
  
  352KB
- MD5
  
  1e4df02f3f4ce624cb038d5198d53b56
- SHA1
  
  466d307b640c1b34ddacd1cf3eae008985ebaf84
- SHA256
  
  6057bf9ebf7eea574188df68f68f8cc94171ab84f9f56bec6d5561648bf219f4
- SHA512
  
  f8fb04d0505757b46d4e4670c3d9b862305db2abf9de5f8352a57b542af5ffef0fb6657d0b7ebdaaba60fc79a85b79c14c5db892b54adaeac04247383e5978a8
- SSDEEP
  
  6144:sV2GCVehspwDhxSrysgO43fmp0G8a6sQPXKwe4:swLehspw1xSrysAc0G8a6sAXKt4
Score

10^/10

smokeloader pu10 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpu10backdoortrojan