smokeloader | ad00935f608b7f69aed4558fc2579345c611a536f8a5ca6756c1bd65c6e9931d | Triage

Sharing

General

Target

ad00935f608b7f69aed4558fc2579345c611a536f8a5ca6756c1bd65c6e9931d
Size

158KB
Sample

241215-q2m88axpdm
MD5

41577f7b8cfa2f3c629909c8c8a411bc
SHA1

001c408460f46a1d488345c62a7e9f5bfdbc8b48
SHA256

ad00935f608b7f69aed4558fc2579345c611a536f8a5ca6756c1bd65c6e9931d
SHA512

dc9c15b6fc469020ad8c45d947178b8089c6124575742b2a1c3398caa9922f4b9c560d986e6d7b86fe29b460ef61190a1cb921c2042614e8c405744cffb0f11f
SSDEEP

3072:JtSTCEaObpdm6tC56EE7kc72AhowDD7TtZH8250RAAcIbQ9P3Kr9/focN049W10U:JkTbpdHCAzD72YrDD7TTc250RAFIc9JJ

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  6e66d55cd25699c37ecb1df293cec91b7d65b855dca2738e0a21fa9c9d75b472
- Size
  
  260KB
- MD5
  
  9b8808042c38d9dcf2fde812022c977d
- SHA1
  
  1636f26de52796009338b301736396bac764bb21
- SHA256
  
  6e66d55cd25699c37ecb1df293cec91b7d65b855dca2738e0a21fa9c9d75b472
- SHA512
  
  2e4fc25e4a8eeb7eb775aba808115490dedc1c33332cd6c31b7902d638efa97e09b3cd3b6fe2479cb74ce56515af8bf2b2dce3c313565f84652c2adfb14cd67a
- SSDEEP
  
  3072:otzWymBhk5wLO45nPcz5KkzJ3qiDD7TtZH8250RAApMbkYyxJZM/h3:vymBO6Lv5nz6jDD7TTc250RAAakL9
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan