smokeloader | 9ec91f257e81696aac31547d2d7579ffe402774d640dcc8583ba719344f4351a | Triage

Sharing

General

Target

9ec91f257e81696aac31547d2d7579ffe402774d640dcc8583ba719344f4351a
Size

189KB
Sample

241215-q4m18swkfy
MD5

035dcaf87b6dc0a71be0f00d79300bde
SHA1

6f6b96a0ce8be42b98d1e99e329baa35a7243c99
SHA256

9ec91f257e81696aac31547d2d7579ffe402774d640dcc8583ba719344f4351a
SHA512

1925abfc9a0ee171c0dc67f78810e8ba74cb16a7fdac9b60b7b4f7d3f32ee5775fb89756bf96434d13a4387150ce8bef3111b47514fd70cd9f053ffdae293a94
SSDEEP

3072:CdXTmjBtFcXFfjuUL52bu/0ZMRI4/cS6t9hjrZAZh+07h5taaecoV:2TqofCUL52u/0xRnZtMfeB

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  9ec91f257e81696aac31547d2d7579ffe402774d640dcc8583ba719344f4351a
- Size
  
  189KB
- MD5
  
  035dcaf87b6dc0a71be0f00d79300bde
- SHA1
  
  6f6b96a0ce8be42b98d1e99e329baa35a7243c99
- SHA256
  
  9ec91f257e81696aac31547d2d7579ffe402774d640dcc8583ba719344f4351a
- SHA512
  
  1925abfc9a0ee171c0dc67f78810e8ba74cb16a7fdac9b60b7b4f7d3f32ee5775fb89756bf96434d13a4387150ce8bef3111b47514fd70cd9f053ffdae293a94
- SSDEEP
  
  3072:CdXTmjBtFcXFfjuUL52bu/0ZMRI4/cS6t9hjrZAZh+07h5taaecoV:2TqofCUL52u/0xRnZtMfeB
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan