smokeloader | dd44c506ac92b842045d14097528d8c0168defea002274e61c73808d427e6b7a | Triage

Sharing

General

Target

dd44c506ac92b842045d14097528d8c0168defea002274e61c73808d427e6b7a
Size

127KB
Sample

241215-rk9asswrby
MD5

31d657ad71ceafea871aaed45fdd1001
SHA1

e4a7ee88ecc918a3592edbad7fd713ba2a94f80b
SHA256

dd44c506ac92b842045d14097528d8c0168defea002274e61c73808d427e6b7a
SHA512

62e0f400363b43a8df592b235f0c7551026b4b80039443e26be9250dcdbbaae23b317b572f1137891a6e307ca74c35c62be276a410568264d87cee331f36475f
SSDEEP

3072:TdnPYvf7IKK66RxR6cH9Ng0R5wruF/pGx9xpZGtYllZKRj:T+IKUJbg0bhGjCYlKj

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  6c389b205fe6ffeb5fcb17f184ab5eb6b5fa5700fda8c5de66a3e7ecf8a36942
- Size
  
  188KB
- MD5
  
  e7de3b19eef5decdd7a45187f30128b5
- SHA1
  
  edbacfde848c0c9f98516557211b2383e9505f10
- SHA256
  
  6c389b205fe6ffeb5fcb17f184ab5eb6b5fa5700fda8c5de66a3e7ecf8a36942
- SHA512
  
  b867b2157a7d5f8d757452b89b8da4efb019ce3f8ddb49625ff47f48357d4a9c2bdabd2767ebf8482de41e84857046d4b955c70f4e5b1b7451726d42f16c4e8c
- SSDEEP
  
  3072:3smiYEA+87tWbxn5Sk3eKVucpGx9xpZGtYlleZfWKm:3si+OgfeiGjCYlUBWn
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan