smokeloader | 5116448b70c18508cf09788a90485e4ff0253df1e595acb5d485e5937d405ee9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5116448b70c18508cf09788a90485e4ff0253df1e595acb5d485e5937d405ee9
Size

351KB
Sample

230415-z7qe7sfg32
MD5

8c38f47e7cc2a4a5d0d45deb31641cec
SHA1

5924af8db6f7e7463b43797dd1624c7f41aa4caf
SHA256

5116448b70c18508cf09788a90485e4ff0253df1e595acb5d485e5937d405ee9
SHA512

63398b319f8a9df934177a76f34967d6f466d623d479eb40a2712f0ce906ed7a18be657c7a19857bd85078d69c052e669899f7046fdcd9d4896b592fbd314714
SSDEEP

6144:PSr6scr8fiD4CNv1+xJiKy1gL5y8taCwe4:PSrJcr8fiD489OJid1+Vtzt4

Score

10^/10

smokeloader pu10 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pu10

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  5116448b70c18508cf09788a90485e4ff0253df1e595acb5d485e5937d405ee9
- Size
  
  351KB
- MD5
  
  8c38f47e7cc2a4a5d0d45deb31641cec
- SHA1
  
  5924af8db6f7e7463b43797dd1624c7f41aa4caf
- SHA256
  
  5116448b70c18508cf09788a90485e4ff0253df1e595acb5d485e5937d405ee9
- SHA512
  
  63398b319f8a9df934177a76f34967d6f466d623d479eb40a2712f0ce906ed7a18be657c7a19857bd85078d69c052e669899f7046fdcd9d4896b592fbd314714
- SSDEEP
  
  6144:PSr6scr8fiD4CNv1+xJiKy1gL5y8taCwe4:PSrJcr8fiD489OJid1+Vtzt4
Score

10^/10

smokeloader pu10 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpu10backdoortrojan