smokeloader | c1a44100e79671e693e8ef87f745fc76bcca58c53e99f9dd93fe15b91f49d006 | Triage

Sharing

General

Target

c1a44100e79671e693e8ef87f745fc76bcca58c53e99f9dd93fe15b91f49d006
Size

261KB
Sample

241215-rbp6kawncz
MD5

45101b98b75fad3d4f972e2cbf4923ac
SHA1

1661cdcfeabd2aa475ba817580820d568b9ce65c
SHA256

c1a44100e79671e693e8ef87f745fc76bcca58c53e99f9dd93fe15b91f49d006
SHA512

3a641c9fd46629d5c55bc4f67e3434d9c8d474bb36fba00354b3b56672f096e8eb9276a198b44939618340c730c8f646ac9a27a78c78fcc12a29a239272d17bf
SSDEEP

3072:HxGmB7A8L5xarcz5cCAAy9UGLDmaBkk7nCaNGxfEYFyKv+KeM/h3:ImBM8LnaX9UGGaBkkL1NYfEuyg+5

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  c1a44100e79671e693e8ef87f745fc76bcca58c53e99f9dd93fe15b91f49d006
- Size
  
  261KB
- MD5
  
  45101b98b75fad3d4f972e2cbf4923ac
- SHA1
  
  1661cdcfeabd2aa475ba817580820d568b9ce65c
- SHA256
  
  c1a44100e79671e693e8ef87f745fc76bcca58c53e99f9dd93fe15b91f49d006
- SHA512
  
  3a641c9fd46629d5c55bc4f67e3434d9c8d474bb36fba00354b3b56672f096e8eb9276a198b44939618340c730c8f646ac9a27a78c78fcc12a29a239272d17bf
- SSDEEP
  
  3072:HxGmB7A8L5xarcz5cCAAy9UGLDmaBkk7nCaNGxfEYFyKv+KeM/h3:ImBM8LnaX9UGGaBkkL1NYfEuyg+5
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan