smokeloader | c69cca323e49a592179750c3cf9328841a8892626839445db6132c1f61b4b1f9 | Triage

Sharing

General

Target

c69cca323e49a592179750c3cf9328841a8892626839445db6132c1f61b4b1f9
Size

167KB
Sample

241108-cpwsyavrbn
MD5

ca47807e84f0cdb557a270fdb04e071c
SHA1

017d03637fc1ca85adb8e47debcd3d0d0f5ad979
SHA256

c69cca323e49a592179750c3cf9328841a8892626839445db6132c1f61b4b1f9
SHA512

c32163d4bdd7da5389d653c69aeb89515be913f733a3982eb82ceb3d9d5d60a32b79c80a78f84a16a4cb203a909bc5cf0ba6b6bd5fb68ba2875c3987c10e2fb3
SSDEEP

3072:TrbZfka8C0qj9IJU4nMgEqS4/TjUHKI9rUm7oIdJCFlTQz+yLQ/mUhkd6xF2eXvp:TJDJ9B4Qp4Hc917ozlTmDLihkdCZXvrF

Score

10^/10

smokeloader pub4 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Targets

- Target
  
  5ec9843a2aee2813c1d99bda8df3a2518457867e63522a5b2075d30b7eead0d5.exe
- Size
  
  277KB
- MD5
  
  74d94dab71aecc2af6b9a98df84e9c1c
- SHA1
  
  4c8e540e20399b74c2161b756e198645a24990fb
- SHA256
  
  5ec9843a2aee2813c1d99bda8df3a2518457867e63522a5b2075d30b7eead0d5
- SHA512
  
  bf54668bb99d451d15eef1a082216989c3a05538226fbbe05d0330c3462304b5bf78638c0ecd3ba6848b6cd6b97b32d9dfa52ee38c1c8cabe2c22b3646fd5c61
- SSDEEP
  
  3072:qoRz8e2BHiAqkUCwTsLMpMvV4kZD3y3VJbqBryE3xYriaN9BcTuR8HQEgWN8aeDr:jFFqJbMpM/MJbguE3NaNUTuR8H6va
Score

10^/10

smokeloader pub4 backdoor trojan discovery
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub4backdoortrojan

behavioral2

smokeloaderpub4backdoordiscoverytrojan