smokeloader | 33d95c1abbd37fb856fe904d85133db11c676e59f5f073da363f1f426a8555fe | Triage

Sharing

General

Target

33d95c1abbd37fb856fe904d85133db11c676e59f5f073da363f1f426a8555fe
Size

221KB
Sample

241215-qzzt8sxngm
MD5

7cf8cd81d4ccb054859b1be355b25c32
SHA1

9aafeb622d65c7e74a485aa7fb1ccf91d15cb817
SHA256

33d95c1abbd37fb856fe904d85133db11c676e59f5f073da363f1f426a8555fe
SHA512

c41c451796abb76d46766d5d70509747de20d5c098b2c32aacd9a8522c16ec92db66ecc8e9890fee3a05138b1a25cae3f55f7b4e68a7ec1252f432adb8cc12e5
SSDEEP

6144:qlq9BP90SivWlv+DJ1vUAUhyhHxKv1MT3W5o3HkaEqLZSKwmfyN4eg1:6q9oPQWDJ183yhH2GjNExqlam647

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  39a0f118ee707e8414855bf061f253f6781bfe8c100ddb1a256b9ece7457d759
- Size
  
  333KB
- MD5
  
  0bba54fc51c0b481f4b64ab693f9892c
- SHA1
  
  937bceb009d72ae2b27ea7e1cfc571a90b48c8a1
- SHA256
  
  39a0f118ee707e8414855bf061f253f6781bfe8c100ddb1a256b9ece7457d759
- SHA512
  
  54590896849e69a72b4d546c552257ec35e673032a7a12ad365f31ba1a82d0cda7861fd012f853c40b5c29725ac2cbc66d327c15b4579978fd84bdc152dba553
- SSDEEP
  
  6144:MEIiuz5mTk1TjlUAUhyhHrlx1Cwph+3oQ9gOU+fzYBb6:WiiM0e3yhHrlx1CwO9gT6
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan