smokeloader | 3976664f712ab0e934cc170f6e85f3646f85336d004368803b3eeccc305f3a02 | Triage

Sharing

General

Target

ede325dea8cedf78d0da55321d32ee1d_JaffaCakes118
Size

231KB
Sample

240920-swh4estfqm
MD5

ede325dea8cedf78d0da55321d32ee1d
SHA1

f70bbc73d4010f3c3a708baf41e57c16f332aab0
SHA256

3976664f712ab0e934cc170f6e85f3646f85336d004368803b3eeccc305f3a02
SHA512

1b20c65aedeefd75d294eb1376640872c8e0db958c22ce0524fc1e76ddb5218fda0f307ed558938a65d8a1c4a33ae10c8cb2139984ea298ab26460a849a8643b
SSDEEP

3072:C/4iwmXbKpqGDzpwqX6HBNEg3xehUcqwZifnbBR5kb8sebxUJgwfNVmjQDGnHFir:CgmbKdv6h3eJqwSVk+bxUJTVfGHBTG5

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  ede325dea8cedf78d0da55321d32ee1d_JaffaCakes118
- Size
  
  231KB
- MD5
  
  ede325dea8cedf78d0da55321d32ee1d
- SHA1
  
  f70bbc73d4010f3c3a708baf41e57c16f332aab0
- SHA256
  
  3976664f712ab0e934cc170f6e85f3646f85336d004368803b3eeccc305f3a02
- SHA512
  
  1b20c65aedeefd75d294eb1376640872c8e0db958c22ce0524fc1e76ddb5218fda0f307ed558938a65d8a1c4a33ae10c8cb2139984ea298ab26460a849a8643b
- SSDEEP
  
  3072:C/4iwmXbKpqGDzpwqX6HBNEg3xehUcqwZifnbBR5kb8sebxUJgwfNVmjQDGnHFir:CgmbKdv6h3eJqwSVk+bxUJTVfGHBTG5
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan