smokeloader | 630af5e320b62eacd7e0d9280d370f22a0d74d42d10c5f6faa520cc9831e9619 | Triage

Sharing

General

Target

630af5e320b62eacd7e0d9280d370f22a0d74d42d10c5f6faa520cc9831e9619
Size

261KB
Sample

241215-rrq3ssypaj
MD5

eef8579422d700ed62c6b924be452d14
SHA1

2370400c8e0df0d1b62828f93d17b36a211dccd4
SHA256

630af5e320b62eacd7e0d9280d370f22a0d74d42d10c5f6faa520cc9831e9619
SHA512

b43a6a9b0746956c3ed99954f5db7669d2294dc959865ebcc66a28c0822eebdda00452688b073c7f7e98103d4fb6460ab36859971ecddbce84396a1a7b6ac6ff
SSDEEP

3072:qErACB9GSLpzK1yz5iKKw6v4xrDIXL5zngB2G/89G4e2kdolZM/h3:UCBgSLdKDwUngBx4e2vlZ

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  630af5e320b62eacd7e0d9280d370f22a0d74d42d10c5f6faa520cc9831e9619
- Size
  
  261KB
- MD5
  
  eef8579422d700ed62c6b924be452d14
- SHA1
  
  2370400c8e0df0d1b62828f93d17b36a211dccd4
- SHA256
  
  630af5e320b62eacd7e0d9280d370f22a0d74d42d10c5f6faa520cc9831e9619
- SHA512
  
  b43a6a9b0746956c3ed99954f5db7669d2294dc959865ebcc66a28c0822eebdda00452688b073c7f7e98103d4fb6460ab36859971ecddbce84396a1a7b6ac6ff
- SSDEEP
  
  3072:qErACB9GSLpzK1yz5iKKw6v4xrDIXL5zngB2G/89G4e2kdolZM/h3:UCBgSLdKDwUngBx4e2vlZ
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan