smokeloader | 929efeca4b70f01cc3e6966f26507402e59cc0f6f4417a226f4db4ca24212ea9 | Triage

Sharing

General

Target

929efeca4b70f01cc3e6966f26507402e59cc0f6f4417a226f4db4ca24212ea9
Size

223KB
Sample

241215-q1p2eswjfw
MD5

2b6ac0ba9749fdebdb2e2abfb107ccf0
SHA1

97b1439dd98f9af7200d7b25f31b76bec86d2c8b
SHA256

929efeca4b70f01cc3e6966f26507402e59cc0f6f4417a226f4db4ca24212ea9
SHA512

60d6a4eeaf3f0dd6d3925b67b8bc6d3f5ac3e42787e6b2aeaef5d941fd9b34b339f8e81feee1bee1bfd5cc0251d6c92cfccf153484c899bf218a8d9e71969486
SSDEEP

6144:9j93agldoAbek8k8jtoQ73w9MGL31OtB6hxsH+ywKWHz:V9Kgw+JuoQ7OBL3U6Y/8z

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  ff6ffcc63dc12d405e86864987dc6472c5fc0c06270536066424a776e6ca6577
- Size
  
  334KB
- MD5
  
  a18b06e3d24618bd73c2b1364d5c1796
- SHA1
  
  ade47e42541cfb9509c2d8d2e33fe1d78a4a1307
- SHA256
  
  ff6ffcc63dc12d405e86864987dc6472c5fc0c06270536066424a776e6ca6577
- SHA512
  
  a6f5e4d2ce5fd5fddfc7ef200450dbe28a8e726100d1c4e452f5897f4a9b733a66be52e10d511d1299d803632dea07fe3704d54110cef8619af68e002301e2d8
- SSDEEP
  
  6144:abUQTzhSfPLclek8k8jPJBpCLhsSh+3oQ9gOU+fzYBb6:xQBSLclJsjCLi9gT6
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan