smokeloader | b70a09957e4c3c82e45ced8077a8986a1d17bae3f426ecef441c6695da91cf8d | Triage

Sharing

General

Target

JaffaCakes118_b70a09957e4c3c82e45ced8077a8986a1d17bae3f426ecef441c6695da91cf8d
Size

129KB
Sample

241225-bm9rcatjcm
MD5

263457b1427bb95b4b1e7b22da9e49af
SHA1

8ee96cb23ca452b97138ec5bc15f063c6bf64049
SHA256

b70a09957e4c3c82e45ced8077a8986a1d17bae3f426ecef441c6695da91cf8d
SHA512

60b61e927e5f027e5e6ec1a932e5ac05ff0a88a24db7f4dcfd0b834f14b2888ad6c6e947147d53423ba9f9f9b04b1ad3845c060dbd146dc99a2993eeffb46217
SSDEEP

3072:QuwWnVi2ID3div7+z50ty7qico/6EHwbMM+dT9xnPW:Znl63dpyu/hH4MMo9x+

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Targets

- Target
  
  80c4fe860cb7b77484c99e18be53dd0604a796b9c9b805a93e9d609493420f59
- Size
  
  294KB
- MD5
  
  4b58f20f6961421ea2bda558780a5c50
- SHA1
  
  3e3bef56cc6b32b440ab47cddbf570997ef14481
- SHA256
  
  80c4fe860cb7b77484c99e18be53dd0604a796b9c9b805a93e9d609493420f59
- SHA512
  
  9616fe68311a7c117f87d4de76d7ab77e2247432ff91be4dc38e16ad3a79a4563cae7b9777c733fe6f9623aa5e8231c24c9105a81df97aeb043bf1e7218b0bf7
- SSDEEP
  
  3072:c/E78L2QQks4h2rJy6dF/dVlZWuof37jY1GwEXaWrxpzbgqruJnfed:0E78L2Qvh27F2uof3P8LHuzbgwuJG
Score

10^/10

smokeloader pub3 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub3backdoordiscoverytrojan

behavioral2

smokeloaderpub3backdoordiscoverytrojan