smokeloader | 7a33f13cab7536657d3e8c34d5d59b6f4eec7b479f1e852fe675b518e4138222 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7a33f13cab7536657d3e8c34d.exe
Size

293KB
Sample

230701-hnmrjafh27
MD5

e858e636547aa1dff328554f5750cb37
SHA1

a96483d7314414755ae9f89e389843ae35d3fece
SHA256

7a33f13cab7536657d3e8c34d5d59b6f4eec7b479f1e852fe675b518e4138222
SHA512

4f95096a29614c6c3b9096fc75ea24aca2e92d619888094a942832d637df9dd55ae1eaa98df37cf3c3d57ad5d633267d019a29cf8f165f09ec4f647981656c30
SSDEEP

1536:duFYySyPIYf3HJRow8Fj7Mt75kwhE7rRAnqQWbL9xRaFgYbsMSu6PZ0LUW14jm7D:sFPziw8tG5sHK6FxRaFgMb

Score

10^/10

smokeloader up3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  7a33f13cab7536657d3e8c34d.exe
- Size
  
  293KB
- MD5
  
  e858e636547aa1dff328554f5750cb37
- SHA1
  
  a96483d7314414755ae9f89e389843ae35d3fece
- SHA256
  
  7a33f13cab7536657d3e8c34d5d59b6f4eec7b479f1e852fe675b518e4138222
- SHA512
  
  4f95096a29614c6c3b9096fc75ea24aca2e92d619888094a942832d637df9dd55ae1eaa98df37cf3c3d57ad5d633267d019a29cf8f165f09ec4f647981656c30
- SSDEEP
  
  1536:duFYySyPIYf3HJRow8Fj7Mt75kwhE7rRAnqQWbL9xRaFgYbsMSu6PZ0LUW14jm7D:sFPziw8tG5sHK6FxRaFgMb
Score

10^/10

smokeloader up3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderup3backdoortrojan

behavioral2

smokeloaderup3backdoortrojan