smokeloader | c9779bfb55b855152347b89c2daa6987c5782aab933c0fc98f9aee50e2c53ba6 | Triage

Sharing

General

Target

JaffaCakes118_c9779bfb55b855152347b89c2daa6987c5782aab933c0fc98f9aee50e2c53ba6
Size

78KB
Sample

241225-c74w9svqfn
MD5

d3d855f2b859810cb4b09fdcc4feb3db
SHA1

67962afafcc38f752a944e1162fa9e4eacb89ad4
SHA256

c9779bfb55b855152347b89c2daa6987c5782aab933c0fc98f9aee50e2c53ba6
SHA512

52120aed552cfde60de6bbd45e77d174d6b8b8fc06502b5b80559610421487ada985cd32fe5844f4da8de8795cf2795bffee132011ce3dc37b5a222ce213004b
SSDEEP

1536:/NEmCIA08BJVOZ9EZlXMy4fQIc28EnjTDxhbd7evzmQNJ/IOiO3w6T:/NlAp6lyyXLDnfDxdd7KzjNJ/9v3Z

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  a6ybp.exe
- Size
  
  133KB
- MD5
  
  5052c5edb614bae7449e4fe24466d312
- SHA1
  
  ac891f7448c5b5bef1e1b0d66fb6a020245131ab
- SHA256
  
  25f38d1847951f8cbf676cd97216c830462bb875c405f781ae053dd8fbfc83f8
- SHA512
  
  c67abfee80001aa589cfc823be86a41ce8ca29bcd01baf57ce588c0ace6a918c650699b397a7baf6948b65cc97e899a43eae55cc8478c7057d2696419a2aef38
- SSDEEP
  
  1536:h1i/R5w3LS++phVPt/4EPdHfXiZWOhVaXoz3ZGvFRLI4c1H35FwCUe0UgcRGx:inOLWhZPxSZbVaXVvFRL41H353U2NGx
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan