smokeloader | 95f88751283272061f2825423adee58354d94fa06148ccd658010707487ef724 | Triage

Sharing

General

Target

95f88751283272061f2825423adee58354d94fa06148ccd658010707487ef724
Size

2.5MB
Sample

241107-tccb7sxpbp
MD5

d718ccb9736375a58e85e65f37ac6e44
SHA1

9ef2ae9c5ee182af47e51e3e0304e331911a5685
SHA256

95f88751283272061f2825423adee58354d94fa06148ccd658010707487ef724
SHA512

d4718337dd8ab9cd78e87331a6ab12e82bad655e39f1c6f47ff388ce2f280694448fab88a457c68df5c30891884f4d47947ccedf153d85c49923bdaafccd2e41
SSDEEP

49152:fNnW8yZQvjT88cKCsZTVaPpQjShi10dahpmruj5VbLZqUlH:f2l8ckqf8oVrOdqUlH

Score

10^/10

smokeloader backdoor discovery evasion trojan

Malware Config

Targets

- Target
  
  95f88751283272061f2825423adee58354d94fa06148ccd658010707487ef724
- Size
  
  2.5MB
- MD5
  
  d718ccb9736375a58e85e65f37ac6e44
- SHA1
  
  9ef2ae9c5ee182af47e51e3e0304e331911a5685
- SHA256
  
  95f88751283272061f2825423adee58354d94fa06148ccd658010707487ef724
- SHA512
  
  d4718337dd8ab9cd78e87331a6ab12e82bad655e39f1c6f47ff388ce2f280694448fab88a457c68df5c30891884f4d47947ccedf153d85c49923bdaafccd2e41
- SSDEEP
  
  49152:fNnW8yZQvjT88cKCsZTVaPpQjShi10dahpmruj5VbLZqUlH:f2l8ckqf8oVrOdqUlH
Score

10^/10

smokeloader backdoor discovery evasion trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoveryevasiontrojan

behavioral2

smokeloaderbackdoordiscoveryevasiontrojan