smokeloader | efca9184fc85781b0998cfa41af4f5449f726d8f050c30cf241b6f75bd2291fd | Triage

Sharing

General

Target

efca9184fc85781b0998cfa41af4f5449f726d8f050c30cf241b6f75bd2291fd
Size

214KB
Sample

241105-p4hwvascmk
MD5

a99b3c64986952f3deb9e791d835e581
SHA1

8c5f56ce07cdd6e0c6a4e055c5843458bf4daae7
SHA256

efca9184fc85781b0998cfa41af4f5449f726d8f050c30cf241b6f75bd2291fd
SHA512

63f265b6db38ddc59cf47f1d04063ff6839b2dfdd793bae3fe0300d1c238663886d793af12577c4a1554f589a1d69da2e3b6298de46cd57749f9c27f96618c0a
SSDEEP

6144:05Cav7YAviw2dlUFs2WW7AOh7sDpmh2tJ1:0Uav7YAvnD7D7skeJ

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  efca9184fc85781b0998cfa41af4f5449f726d8f050c30cf241b6f75bd2291fd
- Size
  
  214KB
- MD5
  
  a99b3c64986952f3deb9e791d835e581
- SHA1
  
  8c5f56ce07cdd6e0c6a4e055c5843458bf4daae7
- SHA256
  
  efca9184fc85781b0998cfa41af4f5449f726d8f050c30cf241b6f75bd2291fd
- SHA512
  
  63f265b6db38ddc59cf47f1d04063ff6839b2dfdd793bae3fe0300d1c238663886d793af12577c4a1554f589a1d69da2e3b6298de46cd57749f9c27f96618c0a
- SSDEEP
  
  6144:05Cav7YAviw2dlUFs2WW7AOh7sDpmh2tJ1:0Uav7YAvnD7D7skeJ
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan