smokeloader | 379788591c7828558577fa608a8bcdfdd07ed23fc337bdd689fe72c572d71568 | Triage

Sharing

General

Target

379788591c7828558577fa608a8bcdfdd07ed23fc337bdd689fe72c572d71568
Size

130KB
Sample

241215-qy9ytaxncq
MD5

a0f27c3e4524ea628701afdf782bc696
SHA1

e9492f98c4d086d14cd18adfd2cea6bef86a3fca
SHA256

379788591c7828558577fa608a8bcdfdd07ed23fc337bdd689fe72c572d71568
SHA512

7d671bf0af9f45499321446631cc434885042bb02a351092f77c3c2aec504d8d3089b1fb63cf132f734516e7c9ed4aaeecb1d32ffb2ed3d4930ae29a20573854
SSDEEP

3072:/EyEZiqnaFhHpW9jGp8Xscy8Tl4eeImEWn2J9ppFpZnweccy:MyO2HsqcNuFrn2JVFpBc7

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  99422254a429f65860b0e0a0df37460f667246617556f963fd9eeae1576c481d
- Size
  
  207KB
- MD5
  
  92ea8d2a8b0bf0e4d01ebf268c31235b
- SHA1
  
  54c15f48800b03fc5c75b399971cb48b83909012
- SHA256
  
  99422254a429f65860b0e0a0df37460f667246617556f963fd9eeae1576c481d
- SHA512
  
  5c3be424e7a05702d640817b025789ad7bb047b052230450862804a1c05cd6692876662811f35bfc581cba718599a65dddb03b7d04c72ea6dac6671c8b69aa48
- SSDEEP
  
  3072:JLMCLs9SfleRFhVDMoDUYbLmip31VhA2NpZsMb8G1tRv4b:eEQV4ebXplVm2L2lGn
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan