smokeloader | 1971f8e513ac05efce84575b72c042677a735f6698d927f0973c50471515abe3 | Triage

Sharing

General

Target

1971f8e513ac05efce84575b72c042677a735f6698d927f0973c50471515abe3
Size

207KB
Sample

241215-qvyrdavqfy
MD5

32733df1e743d6b4eb208bd1e27b7e43
SHA1

13bacf84ecfa60f3866d157ed8458f2bbe6df81c
SHA256

1971f8e513ac05efce84575b72c042677a735f6698d927f0973c50471515abe3
SHA512

6f86d380f8715ebc82c07d8de8f88b574160928c379968f5bc44dfb932be5007bf9b189b437678d2dba09770b39ef760260c90776d47fb5a8f6c605fdb98320d
SSDEEP

6144:XycpF2g9yYyQypsNZ9XzBXBp80zBr991rO:Xyk19dhfXzBX9zBztO

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  29f391a2943fe0a0c48438f4c913fd561e6f6b1d8938b87032851f92de12b7c6
- Size
  
  301KB
- MD5
  
  938569c9966483a8dd41e56c11139efe
- SHA1
  
  92542e43dd51b0205f387e2279a08349dfdfd607
- SHA256
  
  29f391a2943fe0a0c48438f4c913fd561e6f6b1d8938b87032851f92de12b7c6
- SHA512
  
  b86aa27faece20c80391b2a0495902e82dc5914533f9976b9d1ce0d2ea051d3249c7f22d2d539604e63c8f03776a1920d06384f6f58298cd20e19c035f999a6d
- SSDEEP
  
  6144:hd0t2cqpGDT0Q+s8X0m8LrX4lO6fE6Nn:Y8cqQAQ+s0MrDJ6N
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan