smokeloader | a15c2bcc27b1e9b51129f83c9210065a6123cb667c492adb5031000d63cf78b3 | Triage

Sharing

General

Target

a15c2bcc27b1e9b51129f83c9210065a6123cb667c492adb5031000d63cf78b3
Size

163KB
Sample

241110-esxkrasmfn
MD5

ae691cc664f5f28e6f8548acae43c070
SHA1

848312a325dfb8ee83c583c645aead4449c20b63
SHA256

a15c2bcc27b1e9b51129f83c9210065a6123cb667c492adb5031000d63cf78b3
SHA512

6a414d16f3aa7df27560d314b5dcaa000faa872be8a2e51fd1790c802f58b5533dfd18d19c3c6a601ea6e291d9ad01577c330ce28fcbd6cfebdfe5b79cd93c36
SSDEEP

3072:wGYFMLWuyudxqdxd/o0k6AUpO8s4/uE768/d5uxb/BZzS:wrFMLWgdxAxdw07AJE76Kex9Zz

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  a15c2bcc27b1e9b51129f83c9210065a6123cb667c492adb5031000d63cf78b3
- Size
  
  163KB
- MD5
  
  ae691cc664f5f28e6f8548acae43c070
- SHA1
  
  848312a325dfb8ee83c583c645aead4449c20b63
- SHA256
  
  a15c2bcc27b1e9b51129f83c9210065a6123cb667c492adb5031000d63cf78b3
- SHA512
  
  6a414d16f3aa7df27560d314b5dcaa000faa872be8a2e51fd1790c802f58b5533dfd18d19c3c6a601ea6e291d9ad01577c330ce28fcbd6cfebdfe5b79cd93c36
- SSDEEP
  
  3072:wGYFMLWuyudxqdxd/o0k6AUpO8s4/uE768/d5uxb/BZzS:wrFMLWgdxAxdw07AJE76Kex9Zz
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan