smokeloader | a63540d4b4579fea912a2b058e5fa0cf548576b54dbd8230e0d4ce5528cc9f77 | Triage

Sharing

General

Target

a63540d4b4579fea912a2b058e5fa0cf548576b54dbd8230e0d4ce5528cc9f77
Size

206KB
Sample

241215-q96qjayjal
MD5

1a264a4a0df7ded84db69449567bb32e
SHA1

a319c4ead14585e12646228da960877cde9df246
SHA256

a63540d4b4579fea912a2b058e5fa0cf548576b54dbd8230e0d4ce5528cc9f77
SHA512

7f0597c5342a39d3855fd56a99511984d3beca0abca64ab8b81f13f017fab8cd52d43709de73f9143728605de28a9413b1a1e79ae63a31bcba263834741afbfe
SSDEEP

3072:fCQoq8v6N+A1e90s6gsOI5yHwwPKs32doIk/OxguPYC3LNTOv0l15ukUMzm3IyG8:fL8v6NPg6+SwdwVZTOvC1ckUMaOtHj4

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  1bf9d8815e81a8fd4a84ca6d7d5dfedbe6217bb38ae6f133e92bdaf92ec3a4e5
- Size
  
  307KB
- MD5
  
  113967e809d443ef0bde63ca6f10ac68
- SHA1
  
  a492d747458d6119fc4b82b1bcd1ffedb926b265
- SHA256
  
  1bf9d8815e81a8fd4a84ca6d7d5dfedbe6217bb38ae6f133e92bdaf92ec3a4e5
- SHA512
  
  a176c6e3d82fdc725c8bedb8c50a194d8e4ef33fad4e10474cbc74f9334953b5403d06b65dc6c5f62f233728cda00d427cf9a55e2c8dc438f5f7b08886d97989
- SSDEEP
  
  6144:AFKkjLCmOluerYUjnHaRAVkXKhUV3PfzX4KEn2E1a:AFpGmOldr9E6e1PfzX4KUv
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan