smokeloader | 3e8b60d3411a6bc8c26ee9bdf94d8402daedf48228224102c2b14d4c2a18df3e | Triage

Sharing

General

Target

3e8b60d3411a6bc8c26ee9bdf94d8402daedf48228224102c2b14d4c2a18df3e
Size

143KB
Sample

241215-q7vkgsxrcp
MD5

ac9da425d5bf82bca9f1b05042a16083
SHA1

052d3319cc58a7d8131e7ee26842db6f04f1671d
SHA256

3e8b60d3411a6bc8c26ee9bdf94d8402daedf48228224102c2b14d4c2a18df3e
SHA512

d732fd037dee366e942113c209defba676327de19005bd962eb45164b3af4ec179b2ce7cfa51e91043796ac34af0588ca5d456521e1d1a644bab65207afafe5a
SSDEEP

3072:Ia4bZyPey98BVePxfvOTBBRAhum/ye68rMf/VB5WXM6P27BRph6OW0:Ia4f+CMx+TGh7kV/VXWXMMQnph6O9

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  32dbf39892289b33739df3a7f052e0c493bee6cdc2c17102393df4cbf0da1f35
- Size
  
  217KB
- MD5
  
  e5584b1f97d504085e43948c8cb17a27
- SHA1
  
  0513822258e09a477d359f4a96076e77857eb84c
- SHA256
  
  32dbf39892289b33739df3a7f052e0c493bee6cdc2c17102393df4cbf0da1f35
- SHA512
  
  d12706939d70255064d638b6d9704fda706ad56fa71b529ade34dad9f366b8bf92a4cf466bff97503bd2c1cf404cac0324dd93ff525558e209020684086fc06c
- SSDEEP
  
  3072:CtcEoh4G8P46RaruL8GVG6i7RtZ5SdW8YU77yCcNPcisw2Ltq0kKxx:Ct/w6rL8GVG57RKi47yCiEwKtq0k2
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan