smokeloader | da9ef8961f83e2cc480524efa2d0061827d12dd6a4e1cd85f4fa0caa31723355 | Triage

Sharing

General

Target

da9ef8961f83e2cc480524efa2d0061827d12dd6a4e1cd85f4fa0caa31723355
Size

166KB
Sample

241215-q1fgzsxnhq
MD5

89a219b6523a97cc2efccff679fbebb1
SHA1

58da774787ffab56dd929f29e68da3d039f61d96
SHA256

da9ef8961f83e2cc480524efa2d0061827d12dd6a4e1cd85f4fa0caa31723355
SHA512

c1fa4015070549dc7d8e666b76e52fe0ce6e0f8af66df3335451eb4a8320ade6db1305c8f956565cc86a00fc5d9f2de9a06176301ce83397fd27233a4296006d
SSDEEP

3072:owRtE3Khy6YoFlm9RQsuqFxDHXmVlmEewx7f1RT+GtxM2ZlrEfUPhuBzE:ltE3KhR18JHWPe2zXLtzZdbPYo

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  add334ed91b59d9bf632927f367d93cc0abd05e2c6b0c7528cab33a3e4fea535
- Size
  
  260KB
- MD5
  
  297efda7bcbaa24842a097c4f1f1f53c
- SHA1
  
  866f390a00bc074eb2fe3f783aab67bd18e47395
- SHA256
  
  add334ed91b59d9bf632927f367d93cc0abd05e2c6b0c7528cab33a3e4fea535
- SHA512
  
  1c36923ffe49f8bf518650d54e01734f7752522b752d9d96ab53b9bd83990ab0dc1a6786b0ed34585f2303cadee7d224799ef42968da16c921c37f4ca26eab99
- SSDEEP
  
  6144:yO6Pvb9LoWp9UOUCwjr4qs7ylhmblRHR8:yO6Pz9z9UOUCwjFPvmB8
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan