smokeloader | 5e070cc957699c069a4299b9132f578c7b7839a64a06ba9d99b8785f88f9d965 | Triage

Sharing

General

Target

5e070cc957699c069a4299b9132f578c7b7839a64a06ba9d99b8785f88f9d965
Size

268KB
Sample

241215-q1ycsswjf1
MD5

f9f993aaa9bd990f886e620d36a61a46
SHA1

75f0ad44a06d35d6c942faf4fdc18e9d97da7a49
SHA256

5e070cc957699c069a4299b9132f578c7b7839a64a06ba9d99b8785f88f9d965
SHA512

538b189ff58fdc9d3ba1a8290d20272cb17cc9325697d322830c4f18cb817bac647c9d314d6073b2e83d924c90e9cb93f585c88bbe56d449aa0f4d5951a865b5
SSDEEP

6144:JJyHULSmirHOuZzD8tbk75Glehq89ROqsXj:JJyHU+Hruu58tbklOD8Oj

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  5e070cc957699c069a4299b9132f578c7b7839a64a06ba9d99b8785f88f9d965
- Size
  
  268KB
- MD5
  
  f9f993aaa9bd990f886e620d36a61a46
- SHA1
  
  75f0ad44a06d35d6c942faf4fdc18e9d97da7a49
- SHA256
  
  5e070cc957699c069a4299b9132f578c7b7839a64a06ba9d99b8785f88f9d965
- SHA512
  
  538b189ff58fdc9d3ba1a8290d20272cb17cc9325697d322830c4f18cb817bac647c9d314d6073b2e83d924c90e9cb93f585c88bbe56d449aa0f4d5951a865b5
- SSDEEP
  
  6144:JJyHULSmirHOuZzD8tbk75Glehq89ROqsXj:JJyHU+Hruu58tbklOD8Oj
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan