smokeloader | 142a72dce56f800e2b753e4eb1fb24e3c91488c42ef8e911c3025d184e22e063 | Triage

Sharing

General

Target

JaffaCakes118_142a72dce56f800e2b753e4eb1fb24e3c91488c42ef8e911c3025d184e22e063
Size

108KB
Sample

241224-dwnxca1lem
MD5

d7bd3fdb7fc6cc93c1a8d2a50571a407
SHA1

b83330ecdfbe64267beda773ffef13e21cf414ac
SHA256

142a72dce56f800e2b753e4eb1fb24e3c91488c42ef8e911c3025d184e22e063
SHA512

fc2b2e5ace6479b325c528611de84ff318b2d3f212212def3eeaf6307da6d41c731b4481929fefee0ffbddb4ac63a3ccc1e69a5eb9686a5f34bf2eba55620c31
SSDEEP

3072:kkKNAPWtRDYLOYmst099PvVqrKKYgmTakj+lNwOOm1B:kkFW6OGt0D97Kdea5wW

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  g6liy.exe
- Size
  
  172KB
- MD5
  
  d760867ba8a2ea457eb90b2e6a2b72a5
- SHA1
  
  07f29996a386e65fa92d4006c08f0ca2e1d60378
- SHA256
  
  c16bc7ec9c38efe3a4a98ee64ae716e05b265cabc27b8fef334052f61e041a4e
- SHA512
  
  a4fe08caa0db6de82eabc3debb612d7fb3f523745db0a2394d7ddd5ae00aec2ecbcf95626c01ea118a6663d92dc00f0fa75a8e7fc9210e4dc48dfc467e8e0393
- SSDEEP
  
  3072:LrAgLmDnBAK4yREnd50iKkwrZsurix5ir+uIfN8k8QOtq9dC3mS:QgLUBx4y+b0WyXdTKiQOtedL
Score

10^/10

smokeloader backdoor trojan discovery
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan

behavioral2

smokeloaderbackdoordiscoverytrojan