smokeloader | 439ff263fee5373267cc41a3a474877cdb39b1c7e4619d37745982bdecbde352 | Triage

Sharing

General

Target

439ff263fee5373267cc41a3a474877cdb39b1c7e4619d37745982bdecbde352
Size

167KB
Sample

241215-qy1edavrgv
MD5

aecf01df38ae3e650de073930aa063d7
SHA1

0cc92a5f1317541e09f08bd0ee2d9f94c8f64683
SHA256

439ff263fee5373267cc41a3a474877cdb39b1c7e4619d37745982bdecbde352
SHA512

10eac6dec4377f4ca79e4973f803f5a34d71b290d5bd222a3e8da8b571626b1905c549e268cc79fdf4bb77105dfa7e63844afa31a92dabd099e8e76eef8a7720
SSDEEP

3072:6CXj9yuoaoQeARHVia4/4dd282D2wu4SVpK1ia4QWJ5a68RZTBWxRttWBfCfcRrv:6CT9XY3otpL28kOpK14hjZS94xCfCft2

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  00aebdf97b2a0b1950b26118271d0cc23cc673752c1bf80d02877a844c00049d
- Size
  
  260KB
- MD5
  
  f8defac3203ce8ddf5ccc0476dccc3f5
- SHA1
  
  d60bdafe5d21e74f2f3a7758171cefd762a62bb0
- SHA256
  
  00aebdf97b2a0b1950b26118271d0cc23cc673752c1bf80d02877a844c00049d
- SHA512
  
  03e02296ec12957a88cc7bb93b2801d5301b4deccc765b40c8c7ed3b93d919dac4a1c8acb98af1eb76f7e28f5139f9b24e04533653e17814e6c3949fd10ae9f8
- SSDEEP
  
  3072:HXOhB7PZTFPLBXyzpI7n5BInx4i3/TV1CQE93hexA0ysuW7txt58QA8tZ5M/h3R:3s7PFFPL8IN0/TnTbuGCQv8
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan