smokeloader | f5ae9d6e3625bc7404a9f48245bb0b198c3697e85264127cf4db53a0d9df0e29 | Triage

Sharing

General

Target

f5ae9d6e3625bc7404a9f48245bb0b198c3697e85264127cf4db53a0d9df0e29
Size

142KB
Sample

241215-q4644swkhs
MD5

96a40b94bd56d0a4dbe71f4eb6608e7e
SHA1

1e8fa728ca03e2502b610279d39e15e48c932f00
SHA256

f5ae9d6e3625bc7404a9f48245bb0b198c3697e85264127cf4db53a0d9df0e29
SHA512

5fa8a932a8dc7c581fd13ab18a617da5886579208c5dcaeb17cc23976fa8e3dc5e501545bfaffb418cc9bb9dcd8547745bd8e7273a9e267198280e939f72ada6
SSDEEP

3072:xaG/epSHpUV9GaZwMLFceqWtCsQDKs7Q3fVnoJIrx:Ijs1aWM3XCh3inYy

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  5a208f18c51f949e71f6b477d4718579b09e34218691fe904a305efbcfe800bd
- Size
  
  217KB
- MD5
  
  ac7c9f3b7dfb8d2046f55a49d920164f
- SHA1
  
  5c278d1e73bf037d601b87a2a71ecba73a4753d6
- SHA256
  
  5a208f18c51f949e71f6b477d4718579b09e34218691fe904a305efbcfe800bd
- SHA512
  
  16a007bbf5531789baa5e24bbe4239a3e64c5b1be8e94fdbe129a9c826d6c54b826648445b8800303cff55188ceb8a760b411ce6bd704aabc89c603367964c6a
- SSDEEP
  
  3072:XcCMQlRcaxBzNgx0LklC6JJvE56Zaa7O5P1R6XMmdBq/lyJ4bx:XcGXbzRLklCiJvl3YPzYMQBqDb
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan