smokeloader | b12e31077a1ed6213ae8b8862cd30398b9f5ff192f37edb5bdcf13feae8e29fe | Triage

Sharing

General

Target

b12e31077a1ed6213ae8b8862cd30398b9f5ff192f37edb5bdcf13feae8e29fe
Size

373KB
Sample

241215-qy7hpaxncm
MD5

fc6929d01be5b69e53daa60a29cf126f
SHA1

aaad887ee0cdce292a5552c7fdeaf44763fdf5f3
SHA256

b12e31077a1ed6213ae8b8862cd30398b9f5ff192f37edb5bdcf13feae8e29fe
SHA512

e78f18772c992e2f6f3c977e1980a7a2dc8ab53a50ebb34d8b810c9150b7681df0b6dcb305b496caf930dc11c8c20cc3f86005188a100984120bb4331f2ce135
SSDEEP

6144:LVLIN2oLOtrJDYgcvZIB8WYHDXwOu1ql:LV6KtrJAeYjUql

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  b12e31077a1ed6213ae8b8862cd30398b9f5ff192f37edb5bdcf13feae8e29fe
- Size
  
  373KB
- MD5
  
  fc6929d01be5b69e53daa60a29cf126f
- SHA1
  
  aaad887ee0cdce292a5552c7fdeaf44763fdf5f3
- SHA256
  
  b12e31077a1ed6213ae8b8862cd30398b9f5ff192f37edb5bdcf13feae8e29fe
- SHA512
  
  e78f18772c992e2f6f3c977e1980a7a2dc8ab53a50ebb34d8b810c9150b7681df0b6dcb305b496caf930dc11c8c20cc3f86005188a100984120bb4331f2ce135
- SSDEEP
  
  6144:LVLIN2oLOtrJDYgcvZIB8WYHDXwOu1ql:LV6KtrJAeYjUql
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan