smokeloader | 2771bccca50b12b8a6e9103ae38a9666138800c1beb8fb97c2d2ebffdaeb64e9 | Triage

Sharing

General

Target

JaffaCakes118_2771bccca50b12b8a6e9103ae38a9666138800c1beb8fb97c2d2ebffdaeb64e9
Size

129KB
Sample

241223-q9lela1nhx
MD5

ebc11496e375ad20711bf9bf1eb3275f
SHA1

f6512ca602a523bf57cbdf9019c36f5442926ca8
SHA256

2771bccca50b12b8a6e9103ae38a9666138800c1beb8fb97c2d2ebffdaeb64e9
SHA512

9cb5536e71f01437e1d473e608aadc44e6b9b481212dcdd61181197ae9302fb7d653684b81758397c9c7debd8381c49142aa2c575daa10415d689a4516c68489
SSDEEP

3072:wuwWnVi2ID3div7+z50ty7qico/6EHwbMM+dT9xnP2:5nl63dpyu/hH4MMo9xe

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  80c4fe860cb7b77484c99e18be53dd0604a796b9c9b805a93e9d609493420f59
- Size
  
  294KB
- MD5
  
  4b58f20f6961421ea2bda558780a5c50
- SHA1
  
  3e3bef56cc6b32b440ab47cddbf570997ef14481
- SHA256
  
  80c4fe860cb7b77484c99e18be53dd0604a796b9c9b805a93e9d609493420f59
- SHA512
  
  9616fe68311a7c117f87d4de76d7ab77e2247432ff91be4dc38e16ad3a79a4563cae7b9777c733fe6f9623aa5e8231c24c9105a81df97aeb043bf1e7218b0bf7
- SSDEEP
  
  3072:c/E78L2QQks4h2rJy6dF/dVlZWuof37jY1GwEXaWrxpzbgqruJnfed:0E78L2Qvh27F2uof3P8LHuzbgwuJG
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan