smokeloader | f6dbd7deff3d7d6265f975fb067a780536555baa78db06ea6138f39e50712ee9 | Triage

Sharing

General

Target

f6dbd7deff3d7d6265f975fb067a780536555baa78db06ea6138f39e50712ee9
Size

310KB
Sample

241215-q3313axphj
MD5

7244e2dae15e5bca6a5d68590738fa4b
SHA1

5f985b13ec46f1c8d7f2bcdbf48d359a6ba9e514
SHA256

f6dbd7deff3d7d6265f975fb067a780536555baa78db06ea6138f39e50712ee9
SHA512

cba3d4b094413d1137da2bc51dc12efb7601ccdda7e7b1d3477bff3c327e12f7a70281f6b8b3c02a78446a944a0bee6a453040a282082114367928a43cf31104
SSDEEP

6144:1mbCF2Jtek0M8zPH08cwE0Y/VNWMpXsi0OhJMDyo0HyGpNG4O:gbCF2P/J49cwE0qNDXsi0W0yZHyGO4O

Score

10^/10

smokeloader li90 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

li90

Targets

- Target
  
  826b84405feb5e71fd9ea9a8b2d8e6b79ad37487f706d0e10cc61c8884229424
- Size
  
  648KB
- MD5
  
  8f2761d2cbf7b7cf13e4cffb5ef39922
- SHA1
  
  d75f4fa25f1cae8d96825882fa3ebe085e7d3e77
- SHA256
  
  826b84405feb5e71fd9ea9a8b2d8e6b79ad37487f706d0e10cc61c8884229424
- SHA512
  
  8ebc49fcf3c83e8275b202724846348a0886af7171a438d2572125b7314a4863b4cf7676aa9dba0bd1a811ef27ab2d9f12fe4121a96fddfa1f28154386003fa2
- SSDEEP
  
  12288:tUdYc2t6o3liPtHaf6Z5rk3AoML1IvX9Dkntr/wJ69JK1BQfdFyXuwIq8gS:tUdYueYofudk39vNQV06+BQfdFyXrhS
Score

10^/10

smokeloader li90 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderli90backdoordiscoverytrojan

behavioral2

smokeloaderli90backdoordiscoverytrojan