smokeloader | c8f804a821330333cf140c47a8ccc9a4503d5f2f8a6bd582d55469cf88943358 | Triage

Sharing

General

Target

c8f804a821330333cf140c47a8ccc9a4503d5f2f8a6bd582d55469cf88943358
Size

199KB
Sample

241215-qvj8zsxlfp
MD5

84701fcb1e35e22edb7bd5f19434191e
SHA1

f8793a480c7aa2ff476e3a3c777be8d356b554fe
SHA256

c8f804a821330333cf140c47a8ccc9a4503d5f2f8a6bd582d55469cf88943358
SHA512

ea5f8a0657095c5aa6f9e081f1f3533bef1b368c749af3a14967235b889d9667ceb412a2e43169e439dadd2c255e50ac86d5430dffd2f538229737fb20447564
SSDEEP

3072:dojRsJm1DKaxaeliikPd+XKLLT7p0Ya884yG/wFODwPmboaXo4ejRa4ZUAUkOIPQ:ibKad6XXp0iwFOU+boa44ORisZu9

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  b0158fe51d4e8f65bc306a1069abaae7ecee58077a55a6eb0183a96d196ac966
- Size
  
  301KB
- MD5
  
  1b7102cd1be221ad76d36b7616a8cd22
- SHA1
  
  8d4370fcb4a2ad4a8eb1e93b2695061c52241f7d
- SHA256
  
  b0158fe51d4e8f65bc306a1069abaae7ecee58077a55a6eb0183a96d196ac966
- SHA512
  
  fc6fe09325aea294d6eb4cacbb6262043231a49bc5f15041281945960eab1980f287764cf41e4cb478ebcf6e3d46c9210c7871ecf7895f5604e847a825119969
- SSDEEP
  
  3072:oXCP8AaxKsR6MYZhjI5eH/zDh7p0Ya88UFodJ+iPYM/h3isxkgaBChUpZa9uD6Vf:8SpaxPEhjXNp0TXnYeigavwVf
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan