smokeloader | 41c2b9f5a09fe8508924b8c3affc4bf4a25d42bf67243a6a216a9582722b90f1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

347KB
Sample

230416-amrp4agc78
MD5

d8849c5887cb79e57906d9001361db3b
SHA1

e7048d8b8a37478d9c2da39f510c2507a4a4e226
SHA256

41c2b9f5a09fe8508924b8c3affc4bf4a25d42bf67243a6a216a9582722b90f1
SHA512

3b768dac0fd448191bd9ed43bf0dd0ea819db858d5711958a8d7e96322b03906d64b668fb159d9e8beed882ba7824e2c5a9a5eae973f3b6f7ba17cb139c8453a
SSDEEP

6144:BbCqdA2EXYn8BKEPETPE78CBlT/E+oRwfbe4:Bb7dZln8BKEcTMIC9oRgq4

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  setup.exe
- Size
  
  347KB
- MD5
  
  d8849c5887cb79e57906d9001361db3b
- SHA1
  
  e7048d8b8a37478d9c2da39f510c2507a4a4e226
- SHA256
  
  41c2b9f5a09fe8508924b8c3affc4bf4a25d42bf67243a6a216a9582722b90f1
- SHA512
  
  3b768dac0fd448191bd9ed43bf0dd0ea819db858d5711958a8d7e96322b03906d64b668fb159d9e8beed882ba7824e2c5a9a5eae973f3b6f7ba17cb139c8453a
- SSDEEP
  
  6144:BbCqdA2EXYn8BKEPETPE78CBlT/E+oRwfbe4:Bb7dZln8BKEcTMIC9oRgq4
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoortrojan

behavioral2

smokeloaderpub1backdoortrojan