smokeloader | 5d372a19bbdae072e4fb4ff9deded30dbb40f4a74b54fbf77888a1523e864129 | Triage

Sharing

General

Target

d4537efd24d9b886648bd32b6ce4da99_JaffaCakes118
Size

207KB
Sample

241208-akvc7sxlbn
MD5

d4537efd24d9b886648bd32b6ce4da99
SHA1

1a014d098b8ef7ecef5ec124ddef0030c42da509
SHA256

5d372a19bbdae072e4fb4ff9deded30dbb40f4a74b54fbf77888a1523e864129
SHA512

e0db39cd1165f6d34e33f4a31e71a1ff69f48cf3baf291cf873b91954e608b89dd8a89a4f1cafa279936cf22abf4e901290816d649bcbc143e7977618d6e30e4
SSDEEP

3072:qwAEjyMmxU4OmrV5eOInBI3KbT59mLkQAkScsYh6gSVywo3c+:/oq4rrfeBne35a7knGyHM

Score

10^/10

smokeloader 0708 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

0708

Targets

- Target
  
  d4537efd24d9b886648bd32b6ce4da99_JaffaCakes118
- Size
  
  207KB
- MD5
  
  d4537efd24d9b886648bd32b6ce4da99
- SHA1
  
  1a014d098b8ef7ecef5ec124ddef0030c42da509
- SHA256
  
  5d372a19bbdae072e4fb4ff9deded30dbb40f4a74b54fbf77888a1523e864129
- SHA512
  
  e0db39cd1165f6d34e33f4a31e71a1ff69f48cf3baf291cf873b91954e608b89dd8a89a4f1cafa279936cf22abf4e901290816d649bcbc143e7977618d6e30e4
- SSDEEP
  
  3072:qwAEjyMmxU4OmrV5eOInBI3KbT59mLkQAkScsYh6gSVywo3c+:/oq4rrfeBne35a7knGyHM
Score

10^/10

smokeloader 0708 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloader0708backdoordiscoverytrojan

behavioral2

smokeloader0708backdoordiscoverytrojan