smokeloader | c97dd81d3765df90080de66bea1a33b2e4af1f448a49ae986bd559edcb29a90b | Triage

Sharing

General

Target

c97dd81d3765df90080de66bea1a33b2e4af1f448a49ae986bd559edcb29a90b
Size

112KB
Sample

241215-ra5jvsyjcr
MD5

316bb02728055f15f3859c804ecf8744
SHA1

878ea901ff2f720034d99a02f615904ef654c6ed
SHA256

c97dd81d3765df90080de66bea1a33b2e4af1f448a49ae986bd559edcb29a90b
SHA512

35252cd55b56101dcbba2fa1866469d3f946f0d3aca169461cfe7ca6d5cbd3027d7f9681a656d13ea8fffac98ff99e73f5f9f5c5a906bd50d397ca1a9a014f2d
SSDEEP

3072:/WE/sdjbZM+gxVmZnz2P8gLejPpgk5LfEdQRN7X:eE0djby+TodMhbLdd

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  d7cfbcb23bcb4fd8a03b810e8d0c9a4e176eed45f4e6c3267feee3bfc758b944
- Size
  
  163KB
- MD5
  
  a469bc2d35eb9d9fed8edf3d51f666bc
- SHA1
  
  c8633351e6783e06d8dc05c10be0cc9e48e5966d
- SHA256
  
  d7cfbcb23bcb4fd8a03b810e8d0c9a4e176eed45f4e6c3267feee3bfc758b944
- SHA512
  
  7a8bea1f6d4c1319769caa0aeec7ecf9c099afd173c073faf73ae088238a3de3cb4cc45157b79c719c3db15b52fff0d0aaeeeed6c9b3448f2dc4bb66aaf07abc
- SSDEEP
  
  3072:yvJ4+MA5vaIKTd5+/kp59CB8BqYQEdWRmVatSNvk:yi+McfKi/gCBTEoRQMSdk
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan