smokeloader | d86d5540c2f56016d56d065a51921e191d5385cee39ca1393d202207c32a2d99 | Triage

Sharing

General

Target

JaffaCakes118_00c70b6ed4c7aa933cf0f6c87914a4f2
Size

302KB
Sample

241231-cpybrsyndq
MD5

00c70b6ed4c7aa933cf0f6c87914a4f2
SHA1

653110245ae53f02682c0d8c881546b44c281ce7
SHA256

d86d5540c2f56016d56d065a51921e191d5385cee39ca1393d202207c32a2d99
SHA512

f3ea27b57176013ba5d50b5c2c5b91379af39deea81513b7a6bb7eefe8a8a13a309da04461a82ae41ca9d6c99251c2ab72bbae41eb9238620246d9718bac8195
SSDEEP

3072:UPIFSv0+ri4FKLkcuxGIiie08Gdg6ztTgcBTDk3csv7xIEZTHx2z8RtLtoQysLRv:+aBuf8V6JMcBTuvvyYTHAst6QblYAB

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_00c70b6ed4c7aa933cf0f6c87914a4f2
- Size
  
  302KB
- MD5
  
  00c70b6ed4c7aa933cf0f6c87914a4f2
- SHA1
  
  653110245ae53f02682c0d8c881546b44c281ce7
- SHA256
  
  d86d5540c2f56016d56d065a51921e191d5385cee39ca1393d202207c32a2d99
- SHA512
  
  f3ea27b57176013ba5d50b5c2c5b91379af39deea81513b7a6bb7eefe8a8a13a309da04461a82ae41ca9d6c99251c2ab72bbae41eb9238620246d9718bac8195
- SSDEEP
  
  3072:UPIFSv0+ri4FKLkcuxGIiie08Gdg6ztTgcBTDk3csv7xIEZTHx2z8RtLtoQysLRv:+aBuf8V6JMcBTuvvyYTHAst6QblYAB
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan