smokeloader | 81a56fbbe8bb1aa826a3992a276da2ec4764c5ef20be61f82a64cbbdc3b1f914 | Triage

Sharing

General

Target

81a56fbbe8bb1aa826a3992a276da2ec4764c5ef20be61f82a64cbbdc3b1f914
Size

314KB
Sample

241108-xbm9vswpev
MD5

c8b46997277ecf7888f85b2cd10ee230
SHA1

ef347a5b5d2debdfe8ce4e4a754e738d6ba890f5
SHA256

81a56fbbe8bb1aa826a3992a276da2ec4764c5ef20be61f82a64cbbdc3b1f914
SHA512

be4e3b060e97e0804f9611eff8b2ebb5ee86e98e0b93951697b24511e10ee23b68ab9c62e4f08d5abe758fea4e2b16bfb4b5ba57cee05c2270dfd9ac613a9d39
SSDEEP

3072:Hw0my/BSA9FfvSeXA4s8R4gIrRvlMdI6bBgpLFYksexFJOF250G+BEkjv17ome7k:bs8RVIrRGB+L6peJE2Me817c14beb

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  81a56fbbe8bb1aa826a3992a276da2ec4764c5ef20be61f82a64cbbdc3b1f914
- Size
  
  314KB
- MD5
  
  c8b46997277ecf7888f85b2cd10ee230
- SHA1
  
  ef347a5b5d2debdfe8ce4e4a754e738d6ba890f5
- SHA256
  
  81a56fbbe8bb1aa826a3992a276da2ec4764c5ef20be61f82a64cbbdc3b1f914
- SHA512
  
  be4e3b060e97e0804f9611eff8b2ebb5ee86e98e0b93951697b24511e10ee23b68ab9c62e4f08d5abe758fea4e2b16bfb4b5ba57cee05c2270dfd9ac613a9d39
- SSDEEP
  
  3072:Hw0my/BSA9FfvSeXA4s8R4gIrRvlMdI6bBgpLFYksexFJOF250G+BEkjv17ome7k:bs8RVIrRGB+L6peJE2Me817c14beb
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan