smokeloader | 2bebab06c3e3a7f0fc94926abfa86b0682658a1c8939a410581a2ea14800729e | Triage

Sharing

General

Target

2bebab06c3e3a7f0fc94926abfa86b0682658a1c8939a410581a2ea14800729e
Size

140KB
Sample

241215-qz3k5awjdy
MD5

f9dec86760cedec8fd89cf1ff1bddc95
SHA1

985b161596fec47e4134908f76b8852f24559cb3
SHA256

2bebab06c3e3a7f0fc94926abfa86b0682658a1c8939a410581a2ea14800729e
SHA512

001f3db72b4fd4bfb9c38bd9a43fbe290866aa1a34c90241471b013fcd0c143f702502e16c6a6ef8dccdbd0d009e2fe532334dc1a536729732f7c0038b6f1d63
SSDEEP

3072:qdvDDPFWajnYHHRix9bDQKvT0qejBWrt41aA86h76r4hfWWTeVIsKjr:qdwIQROtEe4qUBWrtXChKRWSWsKX

Score

10^/10

smokeloader pub4 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Targets

- Target
  
  c0eade3459a0f351b232a0b64b119ab442bf9ac609f70bad10241051f5e971a3
- Size
  
  217KB
- MD5
  
  ab42bc79872ac06416c526c36f0848a5
- SHA1
  
  77ebae46a6b910b8ca3983981100a62824403089
- SHA256
  
  c0eade3459a0f351b232a0b64b119ab442bf9ac609f70bad10241051f5e971a3
- SHA512
  
  29dca6ccef260060bd0f2eac03dd655648d5c1a7b86cddd36502dbb5c4ab06d533dd0aaccc571402c0eaac81fd6198cd5c1838cfddf9e17a59329ff5ba0d7a45
- SSDEEP
  
  3072:drJbQz4iXmRm0LglC6JJvM5LRDfbOL/WEC9SDAOveQuIExx:drULXMLglCiJvnm68WW
Score

10^/10

smokeloader pub4 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub4backdoordiscoverytrojan

behavioral2

smokeloaderpub4backdoordiscoverytrojan