smokeloader | e8d48108289b9abb6a9e3e9c53b93df38b161113e1c82cd326e1d6aa735ff027 | Triage

Sharing

General

Target

e8d48108289b9abb6a9e3e9c53b93df38b161113e1c82cd326e1d6aa735ff027
Size

131KB
Sample

241215-qyxcqaxnbp
MD5

337dd192b18d082b930fac4b876234af
SHA1

ce94e4c19773c4aed2789a628e39d5a628bafdd3
SHA256

e8d48108289b9abb6a9e3e9c53b93df38b161113e1c82cd326e1d6aa735ff027
SHA512

c8cb1f2c4f72ef7a98b9669f306031a358104291a6e9a55d4c6e8967dc4cb3f6888501a95e5a708a545054880c253934166e1f79bd5202890671bef8c2a167bc
SSDEEP

3072:ZExyRCOkknofeaymgVMJUJrNiXJ4ApLhgfUe:IKNLjVMAiXFLh2Ue

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  215d7a490e356b55917ff2880617bf05fe997e4ca1e3fa142dead9788f61ccb3
- Size
  
  207KB
- MD5
  
  958a7af612780d37c425a50d9fc4d1c9
- SHA1
  
  6f4d5e8e1b8ae54f2c392e8004637d3e6e805db5
- SHA256
  
  215d7a490e356b55917ff2880617bf05fe997e4ca1e3fa142dead9788f61ccb3
- SHA512
  
  ea4c4ef52ffc3bc0d5c376eecea2a434f69c38d81653e8b32d001dcbc4b7da099d1bdf40a82ef80999f9f9fc54d7848b91b1eaf2c6f6d7111d09bfce14b0da61
- SSDEEP
  
  3072:dHMBbkks5p1eR7MAbyRSONWQEFn2IULh6OxPHKEw9Rv47:Wns5piJWS4WQEp2ICgIPqEw9
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan