smokeloader | 800af834218db7c31972c1a69c643bf5b01d52cbb70216fee819fe533161ee83 | Triage

Sharing

General

Target

800af834218db7c31972c1a69c643bf5b01d52cbb70216fee819fe533161ee83
Size

113KB
Sample

241215-rbx66swndt
MD5

3be1a07855fcc285779ec3e4d5cc7c67
SHA1

3d77729cca30eab236d739a9827a515221af93ad
SHA256

800af834218db7c31972c1a69c643bf5b01d52cbb70216fee819fe533161ee83
SHA512

ba0236fd97eb8c3ac7bbda6e120c52fd2ed303fbfb5eb8163dc75d68ea4e0427dd88bb2cd26b26b0fe6856d989003bd50bb89a585a27aecbeff9ff22670ea851
SSDEEP

1536:51BsqWl8sPOnVZvonsSQ1YcnKDn7WNGhapeEpxiJ2To7t2PZMN7yFTL8h7QPf4:P1mFGVZvonsSnHWxwEf+2TycB74

Score

10^/10

smokeloader pub4 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Targets

- Target
  
  85a18de1a349fabf6127fa0b25670468f90111ecd1316dd4ffa1f351cf35296a.exe
- Size
  
  172KB
- MD5
  
  6f775e9bb7ce423747537b419e06b89b
- SHA1
  
  ab2d652d4a514b51b2ac803944c49a8f82daa9f3
- SHA256
  
  85a18de1a349fabf6127fa0b25670468f90111ecd1316dd4ffa1f351cf35296a
- SHA512
  
  6596d1ee950f0fafa22bfe607f5f36efe73011ed92f2d63f98e69c42a416a7967e19f7133678a9ad0c35cb5eaf360aa27bc6ff54d99bea511e9af54cce4128e1
- SSDEEP
  
  3072:IS96fa/5LMvBR0Fo/xRhsERqAVyXNf3aCrcJDV026lbuzUC:PDRLMvBR0FsKXAuZqCrcl76liz
Score

10^/10

smokeloader pub4 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub4backdoordiscoverytrojan

behavioral2

smokeloaderpub4backdoordiscoverytrojan