smokeloader | c140ba82a61c4446855a0bc26312ef06bf19c5647623adfde14a1fe4aa86cecd | Triage

Sharing

General

Target

JaffaCakes118_c140ba82a61c4446855a0bc26312ef06bf19c5647623adfde14a1fe4aa86cecd
Size

119KB
Sample

241223-r3jg4asmby
MD5

6efdaa6c506b19769858494f8a65446e
SHA1

ac6809b534639802f581414934959df3ae179577
SHA256

c140ba82a61c4446855a0bc26312ef06bf19c5647623adfde14a1fe4aa86cecd
SHA512

8b4860a3a26b6d157d43a7f66002f65c2bfc5444ff5f962e4e4a761270086f860572d3eb69fe77d006ffe5624f07f3dc8033300ff90faef91c4ff65cab549056
SSDEEP

3072:83g/e3BLOFfhY7F3IaRjb4bNCXdk5+CkATmUOXhFn0D7XQaenj5aU:83gkBLOFJgFYQH4NcktBPOXhyXynj5B

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  6a22706c0bcda16b41b0957b496a1dbfeebfd4ee192bdf0637e067e38e4a562f
- Size
  
  278KB
- MD5
  
  6e2d03b9f91c96e3226ba849c8bb7754
- SHA1
  
  fb13624c85627f0cdf6372ac74fd5350cb320997
- SHA256
  
  6a22706c0bcda16b41b0957b496a1dbfeebfd4ee192bdf0637e067e38e4a562f
- SHA512
  
  eba678dc99039e229962532d3e6bebd14997d5f900fbfc686ff0a79ac125a6aa637a1a421f2d0536659a7baa009acc1062bda8fe09a152951726cd93b3e6362b
- SSDEEP
  
  3072:TBt3g9ymX3AnuRVYsJgJDjlVr9tqdiBYYdSeWWrxpzbgqru:TrQ5kuPiRJVrs8euzbgwu
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan