smokeloader | 8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7 | Triage

Sharing

General

Target

SecuriteInfo.com.Trojan.PackedNET.1454.25156.3444.exe
Size

929KB
Sample

241106-mpymms1len
MD5

1e05a317170e161ce41edd9576a12112
SHA1

3c51bfe359199206e0179f39ce8657a50a33b452
SHA256

8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7
SHA512

374215799741f0495fa7ad78253e3b1ac904c4d1d91728269ab58cdb9b41d653a8caaa3a5fa1c39ab2422de64c89f3c68bc0bdee7860ed65e94a454f687fdf43
SSDEEP

24576:EUyp9f4yeSmpcK4lpRE8u+vTwQjfmadZ0Tbudct:QPfzmpcpRE8u+vBmaSi2

Score

10^/10

smokeloader backdoor discovery persistence trojan

Malware Config

Targets

- Target
  
  SecuriteInfo.com.Trojan.PackedNET.1454.25156.3444.exe
- Size
  
  929KB
- MD5
  
  1e05a317170e161ce41edd9576a12112
- SHA1
  
  3c51bfe359199206e0179f39ce8657a50a33b452
- SHA256
  
  8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7
- SHA512
  
  374215799741f0495fa7ad78253e3b1ac904c4d1d91728269ab58cdb9b41d653a8caaa3a5fa1c39ab2422de64c89f3c68bc0bdee7860ed65e94a454f687fdf43
- SSDEEP
  
  24576:EUyp9f4yeSmpcK4lpRE8u+vTwQjfmadZ0Tbudct:QPfzmpcpRE8u+vBmaSi2
Score

10^/10

smokeloader backdoor discovery persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverypersistencetrojan