smokeloader | 5d4750e8dfad65f3b4d5e80bc63ab152e5988072f8c4ad03b2176710404bd40d | Triage

Sharing

General

Target

5d4750e8dfad65f3b4d5e80bc63ab152e5988072f8c4ad03b2176710404bd40d
Size

125KB
Sample

241215-qy6w6avrg1
MD5

2a6732c68fb1ab49f0d3450305cfd8e2
SHA1

61f8fa586d9655490ed73d91e72c3da1f73307dd
SHA256

5d4750e8dfad65f3b4d5e80bc63ab152e5988072f8c4ad03b2176710404bd40d
SHA512

4d145d15dbf1b828e2cb91794d5c54fa708a64557006f45757e434ddce2e7dbfa1302e59f5315cf844d1f08b0414d80e0778b28f491831d69095acfb2086817c
SSDEEP

3072:/Cc5qkNU0eSgWa3QXtAej/TcD+/wRt6set5SyGjTkv0wG:Kyqk60eSH7XtLe+/wRnetAlTkHG

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  7976b4458e840efd25ae3940de9bdeb79b1bc66a03fdfca6b9a5e34281a990d7
- Size
  
  200KB
- MD5
  
  95c0405d23576a8306b3735a06958bd4
- SHA1
  
  9dc62bb30c32ad6a4a08fc2e791f82ae374cce0f
- SHA256
  
  7976b4458e840efd25ae3940de9bdeb79b1bc66a03fdfca6b9a5e34281a990d7
- SHA512
  
  a73f5547014fc16cb2b4d6076facc9e94bf3fe9b08fd05f1ddf6d299d75e8a88fbcb177c6830ed9be7f16fa474d821ca520d8a59c3ca847112ec0dae86e947d9
- SSDEEP
  
  3072:aB4Jjqboqnz08GGOHS/oOL3lXOQPZjBb6jEr:vJ7qnzlOy/oQlXlmE
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan