smokeloader | d98f8dbe5657dd907dfdea248c6e861c5e177b05e484d9afa0a1bf6dbf25cc4e | Triage

Sharing

General

Target

d98f8dbe5657dd907dfdea248c6e861c5e177b05e484d9afa0a1bf6dbf25cc4e
Size

166KB
Sample

241108-h9vn9sxmew
MD5

58573d2539ea3d3a57e66292ba2937a9
SHA1

1289bffa2ec3cd168194ae446b9513ce9029df55
SHA256

d98f8dbe5657dd907dfdea248c6e861c5e177b05e484d9afa0a1bf6dbf25cc4e
SHA512

b206bb43e64075526fdc73b56701dc6337320e1d612d3ca1beade64caf30d1929c6c875f1558747e80fbb7d0b5f4203271cab900b21420f3a5874f3f17e7f081
SSDEEP

3072:xQ7h9Bztd/2v7whCom7XTtIMcHEFVggjcGkNIVqIF:ett2v70CTyMmI7ITsq

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  d98f8dbe5657dd907dfdea248c6e861c5e177b05e484d9afa0a1bf6dbf25cc4e
- Size
  
  166KB
- MD5
  
  58573d2539ea3d3a57e66292ba2937a9
- SHA1
  
  1289bffa2ec3cd168194ae446b9513ce9029df55
- SHA256
  
  d98f8dbe5657dd907dfdea248c6e861c5e177b05e484d9afa0a1bf6dbf25cc4e
- SHA512
  
  b206bb43e64075526fdc73b56701dc6337320e1d612d3ca1beade64caf30d1929c6c875f1558747e80fbb7d0b5f4203271cab900b21420f3a5874f3f17e7f081
- SSDEEP
  
  3072:xQ7h9Bztd/2v7whCom7XTtIMcHEFVggjcGkNIVqIF:ett2v70CTyMmI7ITsq
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan