smokeloader | 54207c241b9309f9bf51a57b069fa3c70459d9de3b7daee3e063b171cf1e012e | Triage

Sharing

General

Target

bc273d113b663aaa58f500151d75baa5_JaffaCakes118
Size

312KB
Sample

241203-hg7s5azmdl
MD5

bc273d113b663aaa58f500151d75baa5
SHA1

cec4fbd41871184fdd2977993acb9e4dead31fcf
SHA256

54207c241b9309f9bf51a57b069fa3c70459d9de3b7daee3e063b171cf1e012e
SHA512

de2a4ff764ea45d883293522a6f1fa0d0ea1f6e7d38abae15224eb2813d63d342dcfdbded69a3e4e19e77e37295e35d196ba34d0f02c7309b4f6e06860da4b21
SSDEEP

6144:WJPMNz0+HbrhjY3QxRKFoegpwt/ZwCKUR1qlj+dX7C8Dw5+bbSU:8M5l7NjY3QxROopwt5KnW7Csbb9

Score

10^/10

smokeloader 0708 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

0708

Targets

- Target
  
  bc273d113b663aaa58f500151d75baa5_JaffaCakes118
- Size
  
  312KB
- MD5
  
  bc273d113b663aaa58f500151d75baa5
- SHA1
  
  cec4fbd41871184fdd2977993acb9e4dead31fcf
- SHA256
  
  54207c241b9309f9bf51a57b069fa3c70459d9de3b7daee3e063b171cf1e012e
- SHA512
  
  de2a4ff764ea45d883293522a6f1fa0d0ea1f6e7d38abae15224eb2813d63d342dcfdbded69a3e4e19e77e37295e35d196ba34d0f02c7309b4f6e06860da4b21
- SSDEEP
  
  6144:WJPMNz0+HbrhjY3QxRKFoegpwt/ZwCKUR1qlj+dX7C8Dw5+bbSU:8M5l7NjY3QxROopwt5KnW7Csbb9
Score

10^/10

smokeloader 0708 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloader0708backdoordiscoverytrojan

behavioral2

smokeloader0708backdoordiscoverytrojan