smokeloader | b02ed0cb90849eac8defe6cd1852d58fcb64829f8aef03fe5d13598606592ddd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup.exe
Size

324KB
Sample

230425-axczpahc3w
MD5

59ad9523c63ee3098beaf7ad43101a9c
SHA1

dfcf33ead46e473c145eb25d5755bfeabe43dd45
SHA256

b02ed0cb90849eac8defe6cd1852d58fcb64829f8aef03fe5d13598606592ddd
SHA512

34edabcbe938ec97dcfeeeeb00c9f4d7847f8b1f94a3e1717554add10548640df0729c0784f49cbc4f6803cec7ace38ae14424c239c8805fb40089094116b769
SSDEEP

3072:lkso7ETCyzUs2XCn4rO0RR2uDnqL+c5Wc/oIXtVTJOWgp3UlbhQosCL7KmeYkReh:q9wUC4a0RoGq5Df1OWtlbLLYY/xdaL

Score

10^/10

smokeloader pu10 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pu10

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  setup.exe
- Size
  
  324KB
- MD5
  
  59ad9523c63ee3098beaf7ad43101a9c
- SHA1
  
  dfcf33ead46e473c145eb25d5755bfeabe43dd45
- SHA256
  
  b02ed0cb90849eac8defe6cd1852d58fcb64829f8aef03fe5d13598606592ddd
- SHA512
  
  34edabcbe938ec97dcfeeeeb00c9f4d7847f8b1f94a3e1717554add10548640df0729c0784f49cbc4f6803cec7ace38ae14424c239c8805fb40089094116b769
- SSDEEP
  
  3072:lkso7ETCyzUs2XCn4rO0RR2uDnqL+c5Wc/oIXtVTJOWgp3UlbhQosCL7KmeYkReh:q9wUC4a0RoGq5Df1OWtlbLLYY/xdaL
Score

10^/10

smokeloader pu10 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpu10backdoortrojan

behavioral2

smokeloaderpu10backdoortrojan