smokeloader | 6ff1fcb388ae6d3c3b356bab1a5e94d13c1f44f4ee4d76b9d9e7038994bf81c8 | Triage

Sharing

General

Target

6ff1fcb388ae6d3c3b356bab1a5e94d13c1f44f4ee4d76b9d9e7038994bf81c8
Size

285KB
Sample

241215-rh9hsaymar
MD5

207fc62ea8fb0c99b33610e1fa443d13
SHA1

d075c6776678190b20eec91988d3f5ae4eba010c
SHA256

6ff1fcb388ae6d3c3b356bab1a5e94d13c1f44f4ee4d76b9d9e7038994bf81c8
SHA512

74935fcc03ebab3e7fc52502f0890c6a6fe3987eb983fd3c01b05363655481a8eb43518365bce1a8f9b6641490b316b8bc12abce8d070bf4c09e26a730071061
SSDEEP

3072:4P8Hib54jYiHrriA5EC5YSb9OEm4uAxbUaoWOZnJ1ehHWuWvgCb/Sf:40i4jDHiRC5YSWoQWOZJaRWvgCbq

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  6ff1fcb388ae6d3c3b356bab1a5e94d13c1f44f4ee4d76b9d9e7038994bf81c8
- Size
  
  285KB
- MD5
  
  207fc62ea8fb0c99b33610e1fa443d13
- SHA1
  
  d075c6776678190b20eec91988d3f5ae4eba010c
- SHA256
  
  6ff1fcb388ae6d3c3b356bab1a5e94d13c1f44f4ee4d76b9d9e7038994bf81c8
- SHA512
  
  74935fcc03ebab3e7fc52502f0890c6a6fe3987eb983fd3c01b05363655481a8eb43518365bce1a8f9b6641490b316b8bc12abce8d070bf4c09e26a730071061
- SSDEEP
  
  3072:4P8Hib54jYiHrriA5EC5YSb9OEm4uAxbUaoWOZnJ1ehHWuWvgCb/Sf:40i4jDHiRC5YSWoQWOZJaRWvgCbq
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan