smokeloader | 04c777c9d1768f49575b7f3d09b646f15670a90c7d7fc9c2b56d3d69335900c1 | Triage

Sharing

General

Target

JaffaCakes118_04c777c9d1768f49575b7f3d09b646f15670a90c7d7fc9c2b56d3d69335900c1
Size

312KB
Sample

241225-xdg6masmhx
MD5

95f3cb490c68035100e26fe46de61f67
SHA1

6dd5ea5707b9ae1a0254363fcf0431855d61a7dc
SHA256

04c777c9d1768f49575b7f3d09b646f15670a90c7d7fc9c2b56d3d69335900c1
SHA512

bf8d65a5bb18b6e22696a450c7b5f6f0e2ca4f83432b43525d94f1f76f90b77892f2b18358fa41771fd163d6143d5726dbad4f3490a71357cfc8a19fea1074bf
SSDEEP

6144:8967UZXXeVkFddGOemi5pcqbsdQt4RFvkw:8QwZXrFqTN5pcqiQt4fl

Score

10^/10

smokeloader pub1 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Targets

- Target
  
  JaffaCakes118_04c777c9d1768f49575b7f3d09b646f15670a90c7d7fc9c2b56d3d69335900c1
- Size
  
  312KB
- MD5
  
  95f3cb490c68035100e26fe46de61f67
- SHA1
  
  6dd5ea5707b9ae1a0254363fcf0431855d61a7dc
- SHA256
  
  04c777c9d1768f49575b7f3d09b646f15670a90c7d7fc9c2b56d3d69335900c1
- SHA512
  
  bf8d65a5bb18b6e22696a450c7b5f6f0e2ca4f83432b43525d94f1f76f90b77892f2b18358fa41771fd163d6143d5726dbad4f3490a71357cfc8a19fea1074bf
- SSDEEP
  
  6144:8967UZXXeVkFddGOemi5pcqbsdQt4RFvkw:8QwZXrFqTN5pcqiQt4fl
Score

10^/10

smokeloader pub1 backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderpub1backdoordiscoverytrojan

behavioral2

smokeloaderpub1backdoordiscoverytrojan