smokeloader | 7325d1987f354ada2c46acea0b6f15c7e9554ea60b684014b9d9faf07be99277 | Triage

Submit
Reports

Overview

overview

Static

static

file.exe

windows7-x64

file.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

385KB
Sample

221206-3g5nzsgg4z
MD5

ae25963365dc2c93c15700810dfa9e44
SHA1

c32f51e56f4346d6059e7389cf60c64d772c9e75
SHA256

7325d1987f354ada2c46acea0b6f15c7e9554ea60b684014b9d9faf07be99277
SHA512

a6b095873188b47721e2587f31f38c56374837189d43d2f3076146ba00e70dd0226e978c3b1eff5cacdae891a6e28de12acd8641b8d8ec1d5dd727d4e3412d29
SSDEEP

6144:q+tFEZpK/L1wgCtRMC+qf5PuDcC8frnq7mZvfzGjmDpWcoBlC0FMAsaVe:qgyZaBwgMhEp8fTq7mYjFcWC65s3

Score

10^/10

smokeloader backdoor collection discovery spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

file.exe

Resource

win7-20220901-en

smokeloader backdoor trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

file.exe

Resource

win10v2004-20220812-en

smokeloader backdoor collection discovery spyware stealer trojan

windows10-2004-x64

27 signatures

150 seconds

Malware Config

Targets

- Target
  
  file.exe
- Size
  
  385KB
- MD5
  
  ae25963365dc2c93c15700810dfa9e44
- SHA1
  
  c32f51e56f4346d6059e7389cf60c64d772c9e75
- SHA256
  
  7325d1987f354ada2c46acea0b6f15c7e9554ea60b684014b9d9faf07be99277
- SHA512
  
  a6b095873188b47721e2587f31f38c56374837189d43d2f3076146ba00e70dd0226e978c3b1eff5cacdae891a6e28de12acd8641b8d8ec1d5dd727d4e3412d29
- SSDEEP
  
  6144:q+tFEZpK/L1wgCtRMC+qf5PuDcC8frnq7mZvfzGjmDpWcoBlC0FMAsaVe:qgyZaBwgMhEp8fTq7mYjFcWC65s3
Score

10^/10

smokeloader backdoor trojan collection discovery spyware stealer
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan

behavioral2

smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

© 2018-2025

Terms | Privacy