smokeloader | e03690f4b0af8b4adc2f6a1b131e55be8ab45cafed87e07a8a4becd2a9f31149 | Triage

Sharing

General

Target

e03690f4b0af8b4adc2f6a1b131e55be8ab45cafed87e07a8a4becd2a9f31149N
Size

310KB
Sample

240917-f4n87awgnb
MD5

9834358549428271a3edc03bfed71880
SHA1

c1f9dadc2f5e6597bc147f9301b1e01e0ff6d9b0
SHA256

e03690f4b0af8b4adc2f6a1b131e55be8ab45cafed87e07a8a4becd2a9f31149
SHA512

9c5ea0dd5459383de4a2a06f0e3fc8921b41023d3af0d271daf0e2e9113a81e484dfdad5cff91d218eb7b0dc8f22fd43735a77ac2e7adbae8c15a39fe57836aa
SSDEEP

6144:bz+74FwAlB3LCsnc8UXoJkVLCXunRR1TOtmqysfhoO5GWJl1k5a:bqUFweuFEkVLCo9ytZHh9Sa

Score

10^/10

smokeloader 0204 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

0204

Targets

- Target
  
  e03690f4b0af8b4adc2f6a1b131e55be8ab45cafed87e07a8a4becd2a9f31149N
- Size
  
  310KB
- MD5
  
  9834358549428271a3edc03bfed71880
- SHA1
  
  c1f9dadc2f5e6597bc147f9301b1e01e0ff6d9b0
- SHA256
  
  e03690f4b0af8b4adc2f6a1b131e55be8ab45cafed87e07a8a4becd2a9f31149
- SHA512
  
  9c5ea0dd5459383de4a2a06f0e3fc8921b41023d3af0d271daf0e2e9113a81e484dfdad5cff91d218eb7b0dc8f22fd43735a77ac2e7adbae8c15a39fe57836aa
- SSDEEP
  
  6144:bz+74FwAlB3LCsnc8UXoJkVLCXunRR1TOtmqysfhoO5GWJl1k5a:bqUFweuFEkVLCo9ytZHh9Sa
Score

10^/10

smokeloader 0204 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloader0204backdoordiscoverytrojan

behavioral2

smokeloader0204backdoordiscoverytrojan