smokeloader | 4545e245ad217b352ba5b62e0f7082937492a7cbd2609cb68cbf98e54cfc5bc7 | Triage

Sharing

General

Target

4545e245ad217b352ba5b62e0f7082937492a7cbd2609cb68cbf98e54cfc5bc7
Size

125KB
Sample

241215-q1ssbaxpar
MD5

c4f13e13affa2a76040da411fa7212a3
SHA1

f2f08f7229a661319a742ae2535a10443f693d74
SHA256

4545e245ad217b352ba5b62e0f7082937492a7cbd2609cb68cbf98e54cfc5bc7
SHA512

3842c27482980a6afa3b6613de4b1220b0d8823284458951c4a79a703567b92a11eca10d6f500ba8a9433e08f408ca0e8e1539e48edd20c77bcd4fd0ee8e0409
SSDEEP

3072:NCc5qkNU0eSgWa3QXtAej/TcD+/wRt6set5SyGjTkv0w4:gyqk60eSH7XtLe+/wRnetAlTkH4

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  7976b4458e840efd25ae3940de9bdeb79b1bc66a03fdfca6b9a5e34281a990d7
- Size
  
  200KB
- MD5
  
  95c0405d23576a8306b3735a06958bd4
- SHA1
  
  9dc62bb30c32ad6a4a08fc2e791f82ae374cce0f
- SHA256
  
  7976b4458e840efd25ae3940de9bdeb79b1bc66a03fdfca6b9a5e34281a990d7
- SHA512
  
  a73f5547014fc16cb2b4d6076facc9e94bf3fe9b08fd05f1ddf6d299d75e8a88fbcb177c6830ed9be7f16fa474d821ca520d8a59c3ca847112ec0dae86e947d9
- SSDEEP
  
  3072:aB4Jjqboqnz08GGOHS/oOL3lXOQPZjBb6jEr:vJ7qnzlOy/oQlXlmE
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan