smokeloader | 7ae5d04701cf9ced2c0bf855cd6a8683abee81c8c3c97777e553925f286ce7c2 | Triage

Sharing

General

Target

JaffaCakes118_7ae5d04701cf9ced2c0bf855cd6a8683abee81c8c3c97777e553925f286ce7c2
Size

277KB
Sample

241222-eamylaskgy
MD5

b518c804afea1679b41ab51a3f97f2ce
SHA1

f4e54ba7679cb4b71c06cc9e10f9bb7a4d072ef8
SHA256

7ae5d04701cf9ced2c0bf855cd6a8683abee81c8c3c97777e553925f286ce7c2
SHA512

2e0b28f9047effa47c284f59771b7df28b93f3f03c217ca59521ae72e7f9885130b9ec8cb18b0b7cff6245d6e495fb44b217e223362d325289648e2b731dd0b9
SSDEEP

6144:cFmzjJBIa3QoolCYK355QiP4uotmYQwiTSXJeEW431Ed3:c0BBIXTAYKp5QluoUVuXhEF

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  JaffaCakes118_7ae5d04701cf9ced2c0bf855cd6a8683abee81c8c3c97777e553925f286ce7c2
- Size
  
  277KB
- MD5
  
  b518c804afea1679b41ab51a3f97f2ce
- SHA1
  
  f4e54ba7679cb4b71c06cc9e10f9bb7a4d072ef8
- SHA256
  
  7ae5d04701cf9ced2c0bf855cd6a8683abee81c8c3c97777e553925f286ce7c2
- SHA512
  
  2e0b28f9047effa47c284f59771b7df28b93f3f03c217ca59521ae72e7f9885130b9ec8cb18b0b7cff6245d6e495fb44b217e223362d325289648e2b731dd0b9
- SSDEEP
  
  6144:cFmzjJBIa3QoolCYK355QiP4uotmYQwiTSXJeEW431Ed3:c0BBIXTAYKp5QluoUVuXhEF
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan