smokeloader | 83c5b106283684d7ba11a57caf17168bb728c221f375e1c7679ed56a352fabe0 | Triage

Submit
Reports

Overview

overview

Static

static

file.exe

windows7-x64

file.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

267KB
Sample

230111-eb7pdseb7x
MD5

10c9bc1d36c5241c6ad293602c7298a5
SHA1

240bc4176c7509dc0af94738aba20c101203b1d8
SHA256

83c5b106283684d7ba11a57caf17168bb728c221f375e1c7679ed56a352fabe0
SHA512

56978d5af304be50c3af4cbbffe3a884c56833023e2d49a75af62fc6a910c44b5ee2faab58b5b76974148736df2dabe616babcc004f9b8c734832116f3f0d21f
SSDEEP

3072:1XEHBNBc4WLtjtK6975UtYcbx82TEl0ftb0R80pu9uhyBNCanng0Pb:xa7WLX9ur82G0GR8FuUNng6

Score

10^/10

smokeloader backdoor discovery spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

file.exe

Resource

win7-20221111-en

smokeloader backdoor trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

file.exe

Resource

win10v2004-20220812-en

smokeloader backdoor discovery spyware stealer trojan

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  file.exe
- Size
  
  267KB
- MD5
  
  10c9bc1d36c5241c6ad293602c7298a5
- SHA1
  
  240bc4176c7509dc0af94738aba20c101203b1d8
- SHA256
  
  83c5b106283684d7ba11a57caf17168bb728c221f375e1c7679ed56a352fabe0
- SHA512
  
  56978d5af304be50c3af4cbbffe3a884c56833023e2d49a75af62fc6a910c44b5ee2faab58b5b76974148736df2dabe616babcc004f9b8c734832116f3f0d21f
- SSDEEP
  
  3072:1XEHBNBc4WLtjtK6975UtYcbx82TEl0ftb0R80pu9uhyBNCanng0Pb:xa7WLX9ur82G0GR8FuUNng6
Score

10^/10

smokeloader backdoor trojan discovery spyware stealer
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan

behavioral2

smokeloaderbackdoordiscoveryspywarestealertrojan

© 2018-2025

Terms | Privacy