smokeloader | 9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f | Triage

Sharing

General

Target

9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f
Size

265KB
Sample

230919-yks25sbg3z
MD5

7a63d490060ac081e1008c78fb0135fa
SHA1

81bda021cd9254cf786cf16aedc3b805ef10326f
SHA256

9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f
SHA512

602ef6907cc4b0b2aa16f7d4b5b5ff14c5434ea2a50854ae0fc4583eba77bb043089fb47c8963f0e9b296ee1481f4f32caa69ab48890156ed08e3b50eac11349
SSDEEP

3072:E1XV+uHB6PXCxWFqTBvMYNCoPp17vLAO/b/Bg:YLBOXCxWITBvMY1fFb/

Score

10^/10

smokeloader up3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f
- Size
  
  265KB
- MD5
  
  7a63d490060ac081e1008c78fb0135fa
- SHA1
  
  81bda021cd9254cf786cf16aedc3b805ef10326f
- SHA256
  
  9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f
- SHA512
  
  602ef6907cc4b0b2aa16f7d4b5b5ff14c5434ea2a50854ae0fc4583eba77bb043089fb47c8963f0e9b296ee1481f4f32caa69ab48890156ed08e3b50eac11349
- SSDEEP
  
  3072:E1XV+uHB6PXCxWFqTBvMYNCoPp17vLAO/b/Bg:YLBOXCxWITBvMY1fFb/
Score

10^/10

smokeloader up3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderup3backdoortrojan