smokeloader | 5152c8d313ab69156a39a2aa1ed7db18637b8609b72bfde131618cb2f0e9a9f7 | Triage

Sharing

General

Target

5152c8d313ab69156a39a2aa1ed7db18637b8609b72bfde131618cb2f0e9a9f7
Size

159KB
Sample

241215-q114paxpcj
MD5

860e10ea4d05d1c5e75a1ba8fde63b2c
SHA1

2387d79b11c7ea5d4c14a50d6526e718ef4e7919
SHA256

5152c8d313ab69156a39a2aa1ed7db18637b8609b72bfde131618cb2f0e9a9f7
SHA512

2909ef9b0283742c400bd1892031c534fc5dccb02ce0d7b7d773dd646d8d43846ae0960db02a4aa76d085d80693a5819a39d45b01de80d1e1939270e28a7f063
SSDEEP

3072:quTFm82pqZkqb137jdLWfcOWw+MtiLZIRyQellzjh+uFsiKgpcsmhv:qKcEZR37jUcLMtiLZIUll1hfZXpcsmhv

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  0da9ea842da272fe2101dfa5062bf5755c4940fc3371dc53cee5e4c66afa24b2
- Size
  
  261KB
- MD5
  
  2e8240df083c3e76b535b8e74870204a
- SHA1
  
  d4a9b4c65e6ea4b6fef66b9f691e7788a1aefa19
- SHA256
  
  0da9ea842da272fe2101dfa5062bf5755c4940fc3371dc53cee5e4c66afa24b2
- SHA512
  
  b27d406195ae0afa6787c0f64c0ca5fa92b15129db29711f528a934e7db446914d35cd7329d52811d40b4fcfb7b20beaed5d221687076edb5660d48e735f4921
- SSDEEP
  
  3072:+bRgGMBJlNQbcL0rGZYhz5Kisc3zSrBqdOWw+MtiLZIHLoOruV0yM/h3:jVBLObcL0iZgsmHdLMtiLZIHxruVf
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan