smokeloader | 79db4c7747fe664d2c086af6c24a8d34a3dc5ccc4c79a93b647e1ce0cadb4940 | Triage

Sharing

General

Target

JaffaCakes118_79db4c7747fe664d2c086af6c24a8d34a3dc5ccc4c79a93b647e1ce0cadb4940
Size

176KB
Sample

241224-ybajfavndz
MD5

89877a9235a809fdc784b353f6f50bdf
SHA1

f8792e40420f0c56c99d7300d5008cb8e5c4fd0f
SHA256

79db4c7747fe664d2c086af6c24a8d34a3dc5ccc4c79a93b647e1ce0cadb4940
SHA512

ee36a3f5126dd859164609734b46f76fd239069ae9628b8cba94ae5528950e0e7bd11997f1411531e34fde95f8e15942b973a787e53d84a14c78ad4235f05802
SSDEEP

3072:8qg6zKhPyR8m+GkF0oOrTcpIMZE+fQ9zegSwgPYc3+mVZVaTAt+jOVwt1:Hg4KAR3hrDKtfPge3dZVmNt1

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  1cf27ab77a771ff942b1e2947856844fbab4991cf87aca618968445b5c5d706d
- Size
  
  313KB
- MD5
  
  888928d26bd03678afd9fed0d92f6fc9
- SHA1
  
  37723b453fd3133c01e7a43892b73c6580edd164
- SHA256
  
  1cf27ab77a771ff942b1e2947856844fbab4991cf87aca618968445b5c5d706d
- SHA512
  
  7007ba06a902089229f384650de75abcec8740501f3e6a12f421951689f932582dd5749234b8b635d074b3bdd1061ac786449dd582bdaf840fbdef9bf2bb76f2
- SSDEEP
  
  6144:0H4/g0hr5Y3eofIaxJGgOe8nQGo/GOEEmBbejvf:0Y4OuJI8pd8a/GAmBbe
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan