smokeloader | d0f60f7bae076432f34c3cba6cc1d7680cb07cf8672c119d9663877917bca87c | Triage

Sharing

General

Target

d0f60f7bae076432f34c3cba6cc1d7680cb07cf8672c119d9663877917bca87c
Size

167KB
Sample

241215-q4xknswkgv
MD5

9516defe99e0ae4a91af81b79fc1da1d
SHA1

0702b0041eda52706aed311420fb26fdf653bf31
SHA256

d0f60f7bae076432f34c3cba6cc1d7680cb07cf8672c119d9663877917bca87c
SHA512

dde53c24afbad291fc3e1caa6c8347f1c3494c91cad5341288e79bfd12c4176b8e9b86799f6de1f3e5b7412d5261ff9b049c75c9b3fbbf514387c0da6e31d7d0
SSDEEP

3072:SfWfDRRJL/ZcTVwVv4SmQvKr6EBtlBWZHpCjF8MBYCt21ucHJyhCgUvHJ:+WbRRJ7ZcTo9vg6EBDycFpYpfHJyh2x

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  87c00a2a040a9252e0e5dcf00337e1436c1f30b1c76c41f2fcd07ed71125aa2c
- Size
  
  260KB
- MD5
  
  c7e07f6687d3a0212c4dbb3cd55c632b
- SHA1
  
  b3f1979f6179c7525fc1aa5ebb9810fc15b0f619
- SHA256
  
  87c00a2a040a9252e0e5dcf00337e1436c1f30b1c76c41f2fcd07ed71125aa2c
- SHA512
  
  c99878fc6d742bc5555d3bb14030a452263a18146de8978808f30eab8780b4f7f66829294e71900465877d6d5555f20fb6189a60a77f572c84a9b824e7513bc9
- SSDEEP
  
  3072:nXOyB4PKsFvLNXylt7n5ovscdM744HJk0w0qwMjjAsTZ42R953FM/h3R:Xn4PDFvLIt2u44pk0MIs142R95V8
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan