smokeloader | b04730e2d55e6742d7b52b05cb7b5f5fcedafe4db616229445ee27cbe32f045c | Triage

Sharing

General

Target

b04730e2d55e6742d7b52b05cb7b5f5fcedafe4db616229445ee27cbe32f045c
Size

217KB
Sample

241215-qvv1gsxlgq
MD5

5d9aed4c13b23046ddb13dea788a0d35
SHA1

0b6bf297150d24a7c3a78bc8177d53b3b7ba362d
SHA256

b04730e2d55e6742d7b52b05cb7b5f5fcedafe4db616229445ee27cbe32f045c
SHA512

76501dbc9f753bdf4de0d9998707cd12cf983ec060be73fb8b1f4183036f4956b6c37233ad9388d1b7d0c5bb2481689f5531638b92ff1f8365d16b271e622642
SSDEEP

3072:H4xJWpwy90JAOULLoL43JXdbBtRK67xvf55oChdAvrUsPIuYjojYe+vIYwdrSx:YxU79fLJDRKUxvfh2vrwREse+wfdrS

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  b04730e2d55e6742d7b52b05cb7b5f5fcedafe4db616229445ee27cbe32f045c
- Size
  
  217KB
- MD5
  
  5d9aed4c13b23046ddb13dea788a0d35
- SHA1
  
  0b6bf297150d24a7c3a78bc8177d53b3b7ba362d
- SHA256
  
  b04730e2d55e6742d7b52b05cb7b5f5fcedafe4db616229445ee27cbe32f045c
- SHA512
  
  76501dbc9f753bdf4de0d9998707cd12cf983ec060be73fb8b1f4183036f4956b6c37233ad9388d1b7d0c5bb2481689f5531638b92ff1f8365d16b271e622642
- SSDEEP
  
  3072:H4xJWpwy90JAOULLoL43JXdbBtRK67xvf55oChdAvrUsPIuYjojYe+vIYwdrSx:YxU79fLJDRKUxvfh2vrwREse+wfdrS
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan