smokeloader | b9fd74ec604c94a72b24a3395b7607d195acf20f7f51ceda0976e30e3c3d5ecc | Triage

Sharing

General

Target

b9fd74ec604c94a72b24a3395b7607d195acf20f7f51ceda0976e30e3c3d5ecc
Size

166KB
Sample

241215-rh6rwsyman
MD5

95bb7afea61ef36f63db2e93980fbb43
SHA1

09facbac649be4f363c7ff1b4b16085a4442ba6a
SHA256

b9fd74ec604c94a72b24a3395b7607d195acf20f7f51ceda0976e30e3c3d5ecc
SHA512

aee703066067e246a462bee6d6a17369270930b30ce46f695c391e23cecc516efae76a08c6b5670c1a9210ffa854823b3b0140df907af3e8887288372abb0c7b
SSDEEP

3072:Yk+EEgLVMuZhf2zU3GQ+0AuCsMinyQ3AewJAbt+md/rkjpudspUbgnsDt:YRXIVVhOo2Y1CeyQ3AZJNmMDp0gn2t

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  c534f7cfc62dc838722475d2272efdaac877c7d1617fe2e392a3433393fe4512
- Size
  
  260KB
- MD5
  
  a755e18dab13a29c0a8e12d9aac21778
- SHA1
  
  75c29e65751f8da9e204d95b45d14df194c16c2a
- SHA256
  
  c534f7cfc62dc838722475d2272efdaac877c7d1617fe2e392a3433393fe4512
- SHA512
  
  e568873c3596e0d4d01e34bec2e53ace0ef6f2a3af9e554b36ff7d6ba2d3d9143b695525a007c6aa8ee96602b02884854375890b2b6a20e1dafab97dc9578c91
- SSDEEP
  
  3072:CXO/PKPhyXuLHXYOa7n5n/WqKC4jYTGwE86DnGP6WPbJdiM/h3R:CgKPQXuLXa9/1KC4SA86DW6WW8
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan