smokeloader | 7fda2d19d977a3acb62e447263425063bacd312c0c74625a4dee77f487b33681 | Triage

Sharing

General

Target

7fda2d19d977a3acb62e447263425063bacd312c0c74625a4dee77f487b33681N.exe
Size

184KB
Sample

241217-y1gdaawqft
MD5

d2d211f669fbcd185d1560ad7d883820
SHA1

c345a8cfc75b5ac3f85875c7a7314b49e9b96eba
SHA256

7fda2d19d977a3acb62e447263425063bacd312c0c74625a4dee77f487b33681
SHA512

3abab012b99724221e77ef3575c71b22981065ac17c48dc667eb2e248e6ca98b76d12bdca3136a1bf28fdc970f16b2df86f0e654a3a52f4aedaf56795dc6a640
SSDEEP

3072:a/ZMRZMaR4azP5H5fHRcBX0zc3nbhe00BYZL7vsa5L908+/j0K:6M1R4GtxcB8c3bheBBYZff08Cj

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  7fda2d19d977a3acb62e447263425063bacd312c0c74625a4dee77f487b33681N.exe
- Size
  
  184KB
- MD5
  
  d2d211f669fbcd185d1560ad7d883820
- SHA1
  
  c345a8cfc75b5ac3f85875c7a7314b49e9b96eba
- SHA256
  
  7fda2d19d977a3acb62e447263425063bacd312c0c74625a4dee77f487b33681
- SHA512
  
  3abab012b99724221e77ef3575c71b22981065ac17c48dc667eb2e248e6ca98b76d12bdca3136a1bf28fdc970f16b2df86f0e654a3a52f4aedaf56795dc6a640
- SSDEEP
  
  3072:a/ZMRZMaR4azP5H5fHRcBX0zc3nbhe00BYZL7vsa5L908+/j0K:6M1R4GtxcB8c3bheBBYZff08Cj
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan

behavioral2

smokeloaderpub2backdoordiscoverytrojan