smokeloader | 1ff08fb34d5742e1c7b20a39e9f246770487c74638683a2d427b52ffad9636ea | Triage

Resubmissions

24-12-2024 02:57

241224-dfsklaznfy 10

23-12-2024 19:48

241223-yjl77syrer 10

Sharing

General

Target

JaffaCakes118_1ff08fb34d5742e1c7b20a39e9f246770487c74638683a2d427b52ffad9636ea
Size

119KB
Sample

241224-dfsklaznfy
MD5

9594dc62f637f4dbfc45602890c0a610
SHA1

9b28ea147ee6685555658b49e5e7db7903198583
SHA256

1ff08fb34d5742e1c7b20a39e9f246770487c74638683a2d427b52ffad9636ea
SHA512

050570f6ff8e2629c7b4ee525d283da959e9b965682e87c4c1677b88c90606582c352d175c7c0977a390b7481d74e4b3f7c099676545a168bf0e3881ba5faeb5
SSDEEP

3072:bAu5Mh+BlzEwKgrJVNbdXVDlbuVxn6+u6xGQAZ/M0bo4lkK:0uWh+BJzKwHX/uVch60pZVo4P

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Targets

- Target
  
  07e6ea7c38621a02b0540b002de5c54b741755aa99e180826a67cfad67b7ed6c
- Size
  
  278KB
- MD5
  
  858f367fe6d1df147a669f2b9e8a738c
- SHA1
  
  c3bf6c4f46cbbc59727af176aafeb79df07c9d91
- SHA256
  
  07e6ea7c38621a02b0540b002de5c54b741755aa99e180826a67cfad67b7ed6c
- SHA512
  
  9d8bd0fd573b44c6c11170c543019b12a662b88ef213f6044ac7785132ea39a091ec56ba7305a5bc8fc4a29ec91f3bce1cb5a430fc19de1cfa84ae6942ee00d8
- SSDEEP
  
  3072:BmszqE5oXoA0hRcQ+Jg9kBV9dBDmvKhXcVWrxpzbgqru:B7Oonh2UMdRmvKhSuzbgwu
Score

10^/10

smokeloader pub2 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub2backdoordiscoverytrojan