smokeloader | 3624ab9b0980dd56249699f8c376b0f6d39a62caf6f005df4e68c9a9bee5608e | Triage

Sharing

General

Target

3624ab9b0980dd56249699f8c376b0f6d39a62caf6f005df4e68c9a9bee5608e
Size

420KB
Sample

240813-v79rmasarr
MD5

dd68f137afb95a3a5d43d95b56d8b5f3
SHA1

f073e0954ee6e5b021d4058e81cbcc020b350541
SHA256

3624ab9b0980dd56249699f8c376b0f6d39a62caf6f005df4e68c9a9bee5608e
SHA512

11b156862efa7c5b1eb86dff9e156940c1081da2e99bae2bbbcd2f059fd7b8ed799e4a4226c2fa7b33d3eff6e5cef2d7a36810c8961ea2faa207bd0db312b11e
SSDEEP

6144:ym/WiQ//QXQQK37g/s4UYXa8Jrgh1un004BtzD7xrnqSY+vubsXUST:yqWiQ//QAQKLaDX49BpD7NqSjY0

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  3624ab9b0980dd56249699f8c376b0f6d39a62caf6f005df4e68c9a9bee5608e
- Size
  
  420KB
- MD5
  
  dd68f137afb95a3a5d43d95b56d8b5f3
- SHA1
  
  f073e0954ee6e5b021d4058e81cbcc020b350541
- SHA256
  
  3624ab9b0980dd56249699f8c376b0f6d39a62caf6f005df4e68c9a9bee5608e
- SHA512
  
  11b156862efa7c5b1eb86dff9e156940c1081da2e99bae2bbbcd2f059fd7b8ed799e4a4226c2fa7b33d3eff6e5cef2d7a36810c8961ea2faa207bd0db312b11e
- SSDEEP
  
  6144:ym/WiQ//QXQQK37g/s4UYXa8Jrgh1un004BtzD7xrnqSY+vubsXUST:yqWiQ//QAQKLaDX49BpD7NqSjY0
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan