smokeloader | 1c3ddcfb474d39eb07194f82c5f81db9ac4afcaddbcb6374e7854d9f87e3c373 | Triage

Sharing

General

Target

1c3ddcfb474d39eb07194f82c5f81db9ac4afcaddbcb6374e7854d9f87e3c373
Size

222KB
Sample

241215-q69ysawldz
MD5

bf2338da0a8ca25ec6a359e285bc347e
SHA1

97872292607bfb82ab508b9b65d3dbcd974a3938
SHA256

1c3ddcfb474d39eb07194f82c5f81db9ac4afcaddbcb6374e7854d9f87e3c373
SHA512

f7720fcd82f2ac0d339722910c1c1d3932b1326240d7723ee87af07b13e3928961bacd5a1e2f8a2769f6aebc66ebfe87c2391428fdd0abbd6c99214dd7c401c7
SSDEEP

3072:cex6B7cyt7CMP9U7it0M6xL/Q++YkquCuIexNY5jCiiOKh1T6CnZM76L2iGesTiY:h6VQMP01M4//uzxNYVCiPKRZMOLXgibE

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  2bf4144652ca7d409b72a1d38fe605796323c5a77f9318ebcfbf0179d28a31e7
- Size
  
  334KB
- MD5
  
  3043c1b9768de1a6be6aa1b5e0b426ee
- SHA1
  
  d4092902cf45d1873977478ed07b1443e7f4ab0c
- SHA256
  
  2bf4144652ca7d409b72a1d38fe605796323c5a77f9318ebcfbf0179d28a31e7
- SHA512
  
  151439eec66be334031d6965b6a3850716df650f8e106c11ce0e6235baf545566bcce9abbcf9ccaf53cc4c1f3efb337928cb2f818ec39e97f8dba73b6ebe28ac
- SSDEEP
  
  6144:HvQK5BzKPhnGLzxdjTgEB92th+3oQ9gOU+fzYBb6:YK5kx0zTsm9F9gT6
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan