smokeloader

General

Target
file.exe
Size 241KB
Sample221221-m9pkgacb69
SHA256 e571ff508ec99e5039458b4e0aa2f2badd6f2417371f9d406427d8d055f2d63e
MD5 f5967870b1eb3d4354d6041e09742610
SHA1 8a5e04682d1c4a25b41782ec66f82fd669026237
SHA512 fcaa5f6e4c4d430a0f748445b71e26c86c55fca83c933d11b8f26fe7423e523da8a143c52522c942e14064fecf44f31d741b478878a48bdad8c8a4c6eebebfb5
SSDEEP 3072:IV/fLL3VU2DJF5yfV+J+GpJtPzIoHS8d8rLW4P84nuSe4yHWzcNQK1+eJV5u48:+DLFU8IfQJLvNIwbd8PW85Re32zeRu4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  file.exe
- Size 241KB
- SHA256 e571ff508ec99e5039458b4e0aa2f2badd6f2417371f9d406427d8d055f2d63e
- MD5 f5967870b1eb3d4354d6041e09742610
- SHA1 8a5e04682d1c4a25b41782ec66f82fd669026237
- SHA512 fcaa5f6e4c4d430a0f748445b71e26c86c55fca83c933d11b8f26fe7423e523da8a143c52522c942e14064fecf44f31d741b478878a48bdad8c8a4c6eebebfb5
- SSDEEP 3072:IV/fLL3VU2DJF5yfV+J+GpJtPzIoHS8d8rLW4P84nuSe4yHWzcNQK1+eJV5u48:+DLFU8IfQJLvNIwbd8PW85Re32zeRu4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan collection discovery spyware stealer
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2