smokeloader | 4730579d06899f3bb5391270c30879b20a0e2cc7aaa0e24ab7a88f69e2877449 | Triage

Sharing

General

Target

Trojan.Win32.GCleaner.ASGI.MTB-4730579d06899f3bb5391270c30879b20a0e2cc7aaa0e24ab7a88f69e2877449N
Size

229KB
Sample

240916-wy6jaaserd
MD5

f59dc1c335258d5de9ee910766474850
SHA1

9853ea0685b8bd42ec6b87fbb1e5bdbbc4ec7624
SHA256

4730579d06899f3bb5391270c30879b20a0e2cc7aaa0e24ab7a88f69e2877449
SHA512

748c173534fef5978aeff77b6c7862ce98e09c6891ad9ce71126091412fbdbd7537a236cbcc2c667b29306a9cd4e3ae8edbdcb80f5515b72fe5e0645d0f6a552
SSDEEP

3072:nN+T5o2dc3+RNPshJW3PQrS2XOBZUTNdUmvuQTdzZ/peZmQtjy4f:nN+T5oKcK5sL+QrS2XDbuQTdJEZmQZ

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  Trojan.Win32.GCleaner.ASGI.MTB-4730579d06899f3bb5391270c30879b20a0e2cc7aaa0e24ab7a88f69e2877449N
- Size
  
  229KB
- MD5
  
  f59dc1c335258d5de9ee910766474850
- SHA1
  
  9853ea0685b8bd42ec6b87fbb1e5bdbbc4ec7624
- SHA256
  
  4730579d06899f3bb5391270c30879b20a0e2cc7aaa0e24ab7a88f69e2877449
- SHA512
  
  748c173534fef5978aeff77b6c7862ce98e09c6891ad9ce71126091412fbdbd7537a236cbcc2c667b29306a9cd4e3ae8edbdcb80f5515b72fe5e0645d0f6a552
- SSDEEP
  
  3072:nN+T5o2dc3+RNPshJW3PQrS2XOBZUTNdUmvuQTdzZ/peZmQtjy4f:nN+T5oKcK5sL+QrS2XDbuQTdJEZmQZ
Score

10^/10

smokeloader pub2 backdoor trojan discovery
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoortrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan