smokeloader | 757768465a970aa74cdd702df6f5bf71615a036f1e01fc11d62c101f36647892 | Triage

Sharing

General

Target

757768465a970aa74cdd702df6f5bf71615a036f1e01fc11d62c101f36647892
Size

177KB
Sample

240417-r8kx4sch94
MD5

38ca1387b830848f21f4f865d33fec37
SHA1

c1587e1dc5f4c584065976d02ad04386ff910486
SHA256

757768465a970aa74cdd702df6f5bf71615a036f1e01fc11d62c101f36647892
SHA512

77851fcdcd5d51f10051815b09fb5feb88c48c6d6e577852ae32a2a7134ea7bd6f573e4708bfe06eea30e300173b82d67a250c7562417ff3933187889bde3bac
SSDEEP

3072:jE4Q7JG5gxOIwNCP8uCk7sRl7/+gumhQBsDk5OFnmFaD0luSImcDaAwxe1hMqbCT:jE4Q7I589wQ8uCk7G+dmhQBsDCOFnmcc

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  
  ea040833f500c29fb2229a00c1578500c65fffddab8eea70083ef392cc066bc4.exe
- Size
  
  290KB
- MD5
  
  6db27327a2233d8ee11abbed6229604b
- SHA1
  
  feb1887bd6f9c0f84ed539be18d2812042d87e74
- SHA256
  
  ea040833f500c29fb2229a00c1578500c65fffddab8eea70083ef392cc066bc4
- SHA512
  
  a0fac0a468fbc7d4f4b9a03a2a5fb94ec90172f04805066250a6c2fbf322a149acba3ecfd4cfa6889218e0c51bcece9d26c355cf36d5f939cb828a7735d5c5bf
- SSDEEP
  
  6144:BecoZjpjdRLk/7Y8XOFPN8v9ntG/689RjObRXMA:B+ZjpRRA/7XOFPSvJq68fjObph
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

smokeloaderpub1backdoortrojan

behavioral2

smokeloaderpub1backdoortrojan