smokeloader | c085ae21f3536226d317a92d7943c7a5c58d4d33b17941cb23131f01294c5fd6 | Triage

Sharing

General

Target

02523599.exe
Size

208KB
Sample

230601-r757nafb3y
MD5

de8b620fd1e9886549da1ef48cfbfcb3
SHA1

52133262b5f5280a08e34f61823f3c2bbbc11df1
SHA256

c085ae21f3536226d317a92d7943c7a5c58d4d33b17941cb23131f01294c5fd6
SHA512

6fbd9975456ebfdb4e2e95348feff86554cebc22376a994d9af44c70079a628dbff8cda6a174e35ec92499ab1f20c403bf1e329e73e8b7ee06856ddaaa729770
SSDEEP

3072:wXj9yT+ZhkSxqTGiFfcCz6Te813lWRW02h1q5Z1HZEAb5juU+:kiqxWfV6gS1q5rOit

Score

10^/10

smokeloader up3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  02523599.exe
- Size
  
  208KB
- MD5
  
  de8b620fd1e9886549da1ef48cfbfcb3
- SHA1
  
  52133262b5f5280a08e34f61823f3c2bbbc11df1
- SHA256
  
  c085ae21f3536226d317a92d7943c7a5c58d4d33b17941cb23131f01294c5fd6
- SHA512
  
  6fbd9975456ebfdb4e2e95348feff86554cebc22376a994d9af44c70079a628dbff8cda6a174e35ec92499ab1f20c403bf1e329e73e8b7ee06856ddaaa729770
- SSDEEP
  
  3072:wXj9yT+ZhkSxqTGiFfcCz6Te813lWRW02h1q5Z1HZEAb5juU+:kiqxWfV6gS1q5rOit
Score

10^/10

smokeloader up3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderup3backdoortrojan

behavioral2

smokeloaderup3backdoortrojan