smokeloader | 4ed2036409e55f0a61470f9a8e04613474cfbd0da551c5cde54a942b3c5d0421 | Triage

Sharing

General

Target

98de94ecc9310a6524c7cf71973138a9_JaffaCakes118
Size

123KB
Sample

240815-etxxxatgqa
MD5

98de94ecc9310a6524c7cf71973138a9
SHA1

7ed9c8d7a9e220b60472cb42e957330d6ba3dc5f
SHA256

4ed2036409e55f0a61470f9a8e04613474cfbd0da551c5cde54a942b3c5d0421
SHA512

12a49a8f5bdca24f63ae1cdb38102a5b4ef38664be18c6549a7d05417289f5a9e2aeba89ad02590fd5efc24fb60b47291c043e99c725388cb70b61014b551512
SSDEEP

1536:xESIVhkfQzRnsOvfRh+HKaf7fGiX5ghYI4YLI6b+5rN7Vre/CDkRrmP:xE1hXDmt7DgMY06SrN7s/CDkRrm

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  98de94ecc9310a6524c7cf71973138a9_JaffaCakes118
- Size
  
  123KB
- MD5
  
  98de94ecc9310a6524c7cf71973138a9
- SHA1
  
  7ed9c8d7a9e220b60472cb42e957330d6ba3dc5f
- SHA256
  
  4ed2036409e55f0a61470f9a8e04613474cfbd0da551c5cde54a942b3c5d0421
- SHA512
  
  12a49a8f5bdca24f63ae1cdb38102a5b4ef38664be18c6549a7d05417289f5a9e2aeba89ad02590fd5efc24fb60b47291c043e99c725388cb70b61014b551512
- SSDEEP
  
  1536:xESIVhkfQzRnsOvfRh+HKaf7fGiX5ghYI4YLI6b+5rN7Vre/CDkRrmP:xE1hXDmt7DgMY06SrN7s/CDkRrm
Score

10^/10

smokeloader pub1 backdoor trojan discovery
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoortrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan