smokeloader | 1fd8c724869e294498abca9ce6a3f412206adea7ecd7da199b33d05f8162f438 | Triage

Sharing

General

Target

1fd8c724869e294498abca9ce6a3f412206adea7ecd7da199b33d05f8162f438
Size

272KB
Sample

241215-qzk13swjax
MD5

dcfa6ef8ae5c1fcdd6069b8982b60fb2
SHA1

0c2bc7999391e9888120a21fc43065377af2d971
SHA256

1fd8c724869e294498abca9ce6a3f412206adea7ecd7da199b33d05f8162f438
SHA512

c1dd4b20d5f1d5874c71c1ee19110b9e79bfcde66c07fe9d3c13845845603a3ec502b8afa3c5a81849baf36b320d559e715820ffed626e0a4b5efaf24cf0f442
SSDEEP

6144:QlU65KLQtjVvzfvErGeERmzouIrDHDS8uzbgwuXlgwVfd:Qa65KEtBvzX0cioPTunnoR

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  1fd8c724869e294498abca9ce6a3f412206adea7ecd7da199b33d05f8162f438
- Size
  
  272KB
- MD5
  
  dcfa6ef8ae5c1fcdd6069b8982b60fb2
- SHA1
  
  0c2bc7999391e9888120a21fc43065377af2d971
- SHA256
  
  1fd8c724869e294498abca9ce6a3f412206adea7ecd7da199b33d05f8162f438
- SHA512
  
  c1dd4b20d5f1d5874c71c1ee19110b9e79bfcde66c07fe9d3c13845845603a3ec502b8afa3c5a81849baf36b320d559e715820ffed626e0a4b5efaf24cf0f442
- SSDEEP
  
  6144:QlU65KLQtjVvzfvErGeERmzouIrDHDS8uzbgwuXlgwVfd:Qa65KEtBvzX0cioPTunnoR
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan