smokeloader | 33a4297298b2ca7b92d4462884eb53abda20d500998e1edb4bc8e7cb646bba1f | Triage

Sharing

General

Target

c86c3183fa6d592afe2d5d3f5ab2102f_JaffaCakes118
Size

180KB
Sample

241205-tagh5sxlek
MD5

c86c3183fa6d592afe2d5d3f5ab2102f
SHA1

9d0b8ccfad76fdb0a4c7a5c33bcbc22382d925d7
SHA256

33a4297298b2ca7b92d4462884eb53abda20d500998e1edb4bc8e7cb646bba1f
SHA512

04adde0aca8cf31f508a517171d0ae1b9c0749a1a50ec0120e69ca527193c63cee1f82e4f6ce4f5831ffe4e406e1b371c3dcbac2a9008703868b54c07a8f6057
SSDEEP

3072:weD8VM8wtuR87ciE5NDP538a4ROSzxECZA9:wBouGoiEhOROSzxECi

Score

10^/10

smokeloader 0708 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

0708

Targets

- Target
  
  c86c3183fa6d592afe2d5d3f5ab2102f_JaffaCakes118
- Size
  
  180KB
- MD5
  
  c86c3183fa6d592afe2d5d3f5ab2102f
- SHA1
  
  9d0b8ccfad76fdb0a4c7a5c33bcbc22382d925d7
- SHA256
  
  33a4297298b2ca7b92d4462884eb53abda20d500998e1edb4bc8e7cb646bba1f
- SHA512
  
  04adde0aca8cf31f508a517171d0ae1b9c0749a1a50ec0120e69ca527193c63cee1f82e4f6ce4f5831ffe4e406e1b371c3dcbac2a9008703868b54c07a8f6057
- SSDEEP
  
  3072:weD8VM8wtuR87ciE5NDP538a4ROSzxECZA9:wBouGoiEhOROSzxECi
Score

10^/10

smokeloader 0708 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloader0708backdoordiscoverytrojan

behavioral2

smokeloader0708backdoordiscoverytrojan