smokeloader | 0d2f8bf4c72d66348f3f7e4512ec093904062fc0c84a9a73084232fc78279366 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d2f8bf4c72d66348f3f7e4512ec093904062fc0c84a9a73084232fc78279366
Size

319KB
Sample

230511-tnexgace42
MD5

b7119dfeaa2bf17c1fd13ab90111e809
SHA1

7feb88210e8427cf20244975995883a86a600218
SHA256

0d2f8bf4c72d66348f3f7e4512ec093904062fc0c84a9a73084232fc78279366
SHA512

71d2a62bd581d5de9fa7aa32d986c3577d4e5053a2f94709f591cf15831001ebf01b2334206a48b40fbb9bc9b2a6991fe6e04160d1aca40667b72936f57c335a
SSDEEP

6144:4qULLAlnk7aErn0KP6KuumonCCq0V4Q+Vi4nQY:4fMlnktLd6Ku9gk0V4Jrn

Score

10^/10

smokeloader pu10 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pu10

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  0d2f8bf4c72d66348f3f7e4512ec093904062fc0c84a9a73084232fc78279366
- Size
  
  319KB
- MD5
  
  b7119dfeaa2bf17c1fd13ab90111e809
- SHA1
  
  7feb88210e8427cf20244975995883a86a600218
- SHA256
  
  0d2f8bf4c72d66348f3f7e4512ec093904062fc0c84a9a73084232fc78279366
- SHA512
  
  71d2a62bd581d5de9fa7aa32d986c3577d4e5053a2f94709f591cf15831001ebf01b2334206a48b40fbb9bc9b2a6991fe6e04160d1aca40667b72936f57c335a
- SSDEEP
  
  6144:4qULLAlnk7aErn0KP6KuumonCCq0V4Q+Vi4nQY:4fMlnktLd6Ku9gk0V4Jrn
Score

10^/10

smokeloader pu10 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpu10backdoortrojan