smokeloader | 6982578f0c5bf8815e82c4fb2d790457c769448998ac8f3c20a1bb79c7deb1ef | Triage

Sharing

General

Target

e2dd7daad2ae1ce337dec06a2da21c4e_JaffaCakes118
Size

192KB
Sample

240915-thnbnasdpm
MD5

e2dd7daad2ae1ce337dec06a2da21c4e
SHA1

9a138cc60e99eafa3ad251c1b4132ce654abf6d3
SHA256

6982578f0c5bf8815e82c4fb2d790457c769448998ac8f3c20a1bb79c7deb1ef
SHA512

243ed9706ac947f9b79837aabc97edb352e47ae09724444c8ca5eb728bb1446d8685a6b6bf84d456005c8ca0bbfdae1c47951aaa84ee65ea84f40c7f364c5d32
SSDEEP

3072:Jc2gqRP1B5eZxnO06oAIMR5pQP4+ZfBy9Otf4QpUuTEiIkP1U:JfgqRP1B5IwXzXrpQP4ABy81pPjIkPG

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  GZM1925_kansas.com
- Size
  
  233KB
- MD5
  
  8f351981fe3674b7df70d5efcae20b80
- SHA1
  
  d445fdc8b283611313ee45334a7646891cb865d2
- SHA256
  
  febbc268d54ae4612531ceb696c39bd8c0a60ea22d2877751eecce32bd651257
- SHA512
  
  63f47d19bbc1db4107277a878c8ae3a6f3447bf51cb8a26843276bf290baf21690cda613ffde158d7b64f12df4740595f74e7e15973e1d715422e3ea10577395
- SSDEEP
  
  6144:9NaAAXMNwTkk67xtcmuHMlwBqjFR43j+aHQ2IVU:Ta5MNwlyKQr4z+aHQ2UU
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan