smokeloader | db4006c30ea18cd4caf27befc19868a39354db6ba6d1d557a5dbf06aa822873f | Triage

Sharing

General

Target

db4006c30ea18cd4caf27befc19868a39354db6ba6d1d557a5dbf06aa822873f.exe
Size

233KB
Sample

241120-1whrnavell
MD5

8356d47ebfc60ec96c0457c2f2c720bd
SHA1

42bb6422d2b16a106a2f5a2d9a418e2a68d27f9d
SHA256

db4006c30ea18cd4caf27befc19868a39354db6ba6d1d557a5dbf06aa822873f
SHA512

8191c47604a32cd4879820c68d4c51249adc236d29e0447633a687acda20bce47473debe930a649c8537281200b73ab0214de8e1a5d9fa684d20e2f6a58e493c
SSDEEP

3072:dGhKSUgxInv9korQ/qRXzO6P52i6vsiXgdNX+CNf4/AWaSkSJu98vdN:JgxInv9dCyV52i6vjXgdN3IADG8elN

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  db4006c30ea18cd4caf27befc19868a39354db6ba6d1d557a5dbf06aa822873f.exe
- Size
  
  233KB
- MD5
  
  8356d47ebfc60ec96c0457c2f2c720bd
- SHA1
  
  42bb6422d2b16a106a2f5a2d9a418e2a68d27f9d
- SHA256
  
  db4006c30ea18cd4caf27befc19868a39354db6ba6d1d557a5dbf06aa822873f
- SHA512
  
  8191c47604a32cd4879820c68d4c51249adc236d29e0447633a687acda20bce47473debe930a649c8537281200b73ab0214de8e1a5d9fa684d20e2f6a58e493c
- SSDEEP
  
  3072:dGhKSUgxInv9korQ/qRXzO6P52i6vsiXgdNX+CNf4/AWaSkSJu98vdN:JgxInv9dCyV52i6vjXgdN3IADG8elN
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan