smokeloader | 865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe
Size

195KB
Sample

230630-pk2vlsbh61
MD5

5a78962af28ad4733562fbbe0b73c8ae
SHA1

35fcf2c3ef89eb96dd3923a091d7a1404b600630
SHA256

865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0
SHA512

31aa2dcccd58051f60bbf367f7290f4d4b7505f8f5f6616d9bf576b54645422af0717960ef55f61c66d003f422375d3613a684e419843c7a1941f1e17a968264
SSDEEP

3072:lXZqhGLcCLZycXSVx5P7C5/uEfvAo0Eri0W+GYcqUkZh6t2:hkCLlSVS5/uqUEmfXu768

Score

10^/10

smokeloader lab backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

lab

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe
- Size
  
  195KB
- MD5
  
  5a78962af28ad4733562fbbe0b73c8ae
- SHA1
  
  35fcf2c3ef89eb96dd3923a091d7a1404b600630
- SHA256
  
  865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0
- SHA512
  
  31aa2dcccd58051f60bbf367f7290f4d4b7505f8f5f6616d9bf576b54645422af0717960ef55f61c66d003f422375d3613a684e419843c7a1941f1e17a968264
- SSDEEP
  
  3072:lXZqhGLcCLZycXSVx5P7C5/uEfvAo0Eri0W+GYcqUkZh6t2:hkCLlSVS5/uqUEmfXu768
Score

10^/10

smokeloader lab backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderlabbackdoortrojan

behavioral2

smokeloaderlabbackdoortrojan