smokeloader | 4eaedbcf172906a0479c5a5c79ba25ab5d874db37ce8441e85bd14502c223955 | Triage

Sharing

General

Target

4eaedbcf172906a0479c5a5c79ba25ab5d874db37ce8441e85bd14502c223955
Size

272KB
Sample

241215-q2exvaxpcq
MD5

db35edf8d4310f37ef67ded609224c77
SHA1

c9958d9128a603602681b012474bada9265a0dd9
SHA256

4eaedbcf172906a0479c5a5c79ba25ab5d874db37ce8441e85bd14502c223955
SHA512

91ed64f75fb78e0996bb83c7a06a8996493bf0d1909b2b27b8fd4ebc0cd66a4c2384529cad0672d0966c28053932588108fc558ee8637425552441bb924d31b1
SSDEEP

6144:EqulKzGMz+9YfGcWSA6fQH0UkHhSfbr5W:E9KGMBfGcWSPFBH0fbrU

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  4eaedbcf172906a0479c5a5c79ba25ab5d874db37ce8441e85bd14502c223955
- Size
  
  272KB
- MD5
  
  db35edf8d4310f37ef67ded609224c77
- SHA1
  
  c9958d9128a603602681b012474bada9265a0dd9
- SHA256
  
  4eaedbcf172906a0479c5a5c79ba25ab5d874db37ce8441e85bd14502c223955
- SHA512
  
  91ed64f75fb78e0996bb83c7a06a8996493bf0d1909b2b27b8fd4ebc0cd66a4c2384529cad0672d0966c28053932588108fc558ee8637425552441bb924d31b1
- SSDEEP
  
  6144:EqulKzGMz+9YfGcWSA6fQH0UkHhSfbr5W:E9KGMBfGcWSPFBH0fbrU
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan