smokeloader | c90647b4b0d2c8e11dc1eaff07e21d625994ff76613234bd66ea136db23cfe52 | Triage

Sharing

General

Target

c90647b4b0d2c8e11dc1eaff07e21d625994ff76613234bd66ea136db23cfe52
Size

159KB
Sample

241215-q7rtlawlez
MD5

cb2bb7acef4512071dfb406bccceb7e0
SHA1

f688bf868f399ad8ff618d46642639ae09cf69a3
SHA256

c90647b4b0d2c8e11dc1eaff07e21d625994ff76613234bd66ea136db23cfe52
SHA512

218d9124ba6d975fda00504e97a539596ea36ee8a01ff3a1de2af6d5b22edbeac69a1cbc0b75cc3c875f056e805656cfe709d627f3267b53440ef32478f6e6fc
SSDEEP

3072:fi2wWFS2iNJTefDlgFaIBrAeAP5ArjbpQQ72JbpSeq+EshUOz3+zzB0HivCdMJ5e:fiWFS2iCfR7IlAe6QjNQ02nSohNtiqdz

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  25914384c363bf92d3fca8d2eaedeea6c1b55ea4082bd20ed0645d422c9978a8
- Size
  
  260KB
- MD5
  
  ae3447d506e97ab1cec8c259b2b3ceed
- SHA1
  
  fa8f02bed629fd98d6525a5e4683245c81df8fe2
- SHA256
  
  25914384c363bf92d3fca8d2eaedeea6c1b55ea4082bd20ed0645d422c9978a8
- SHA512
  
  e5568e96548253f46053a4194a6cc53f49e0f2c149377069bf073da7fd67f6c4e65fbe6d4a4503c4c75a1f64ce24660d81e351382b2bcefcffab0458290897d0
- SSDEEP
  
  3072:5ZlSBYz5nLB3Tevz58O9CS9FjbpQQ72JbpSeq+Sg7oEaVVlM/h3:RSBetLFTA9FjNQ02nSmY
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan