smokeloader | 65676825fb23d057a89e3eb887b400ff5d2812572e075f10f6347194e234b083 | Triage

Sharing

General

Target

65676825fb23d057a89e3eb887b400ff5d2812572e075f10f6347194e234b083
Size

159KB
Sample

241215-rhecmsylgn
MD5

602c5e7c49827bbbaaf47ba5a42921ef
SHA1

228bb67cd466794cefa4fc36f47792ab8ff6bf9d
SHA256

65676825fb23d057a89e3eb887b400ff5d2812572e075f10f6347194e234b083
SHA512

a8c3676852ac92cbab86a94aaa978fd6f9af7b221a98d40735e426c4ebe8bd91e6cc19af2de9463b9bef1f4cbb136a655867104389456c15004f33cceb114486
SSDEEP

3072:57/+Gu0Nywnr13cvtVPByRVXpTTQoaU/ld2tMbE85c2Ud0e:57WGFNyU13esXpTTRlQc5gb

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  06d78b4780771dea41a408310505710fdd76c9d4288c135a94e8a1fc39564c14
- Size
  
  260KB
- MD5
  
  8c280cce6503c40c4823faa8b13a9b52
- SHA1
  
  f98a38817b4e3e80c9d89e1fc9bdf33f9041dced
- SHA256
  
  06d78b4780771dea41a408310505710fdd76c9d4288c135a94e8a1fc39564c14
- SHA512
  
  192d679e7016345e3a4166c7cbe6911cbe091459de1ffe9b8da4ff11c89d52b174c2208d607784f69762bf4a57bc3e5d11e6c1159b9f3b5b6636f98d4c072753
- SSDEEP
  
  3072:vwVFB2ji6zL1ctObz5XBU+J45lqoXpTTQoaU/ldXkjpfr4FiM/h3:EFBMzzLmtkf45VXpTTRlqjpr4g
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan