smokeloader | a94985a078cfe063c123d02b1c6ef2518c9fffe6b2e6b6995d5fac9212e1b6c8 | Triage

Sharing

General

Target

JaffaCakes118_3b8e44fcf99934a199c5ada61fe65ac4
Size

334KB
Sample

250106-1c2enazrek
MD5

3b8e44fcf99934a199c5ada61fe65ac4
SHA1

41f7fabdcb0deafa2195a47885a73b0b778ea25c
SHA256

a94985a078cfe063c123d02b1c6ef2518c9fffe6b2e6b6995d5fac9212e1b6c8
SHA512

3a272431ea2cc770972b6d0e72bcb3e5b52ca8b49475de0cdd5817d72c1821045cd4583dc05570e7fc8e5ba3a79b612c2a6ccbd4790923cf6f9c641dae2e749a
SSDEEP

6144:NtpCfrqF/YMM5elwLGrCGkrWx52N6DQohEuVywJGjDGS0PnpZkWhW+hKw:NbCfs/YMigOGuGJGN60KXIwIjD/Sjk1

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_3b8e44fcf99934a199c5ada61fe65ac4
- Size
  
  334KB
- MD5
  
  3b8e44fcf99934a199c5ada61fe65ac4
- SHA1
  
  41f7fabdcb0deafa2195a47885a73b0b778ea25c
- SHA256
  
  a94985a078cfe063c123d02b1c6ef2518c9fffe6b2e6b6995d5fac9212e1b6c8
- SHA512
  
  3a272431ea2cc770972b6d0e72bcb3e5b52ca8b49475de0cdd5817d72c1821045cd4583dc05570e7fc8e5ba3a79b612c2a6ccbd4790923cf6f9c641dae2e749a
- SSDEEP
  
  6144:NtpCfrqF/YMM5elwLGrCGkrWx52N6DQohEuVywJGjDGS0PnpZkWhW+hKw:NbCfs/YMigOGuGJGN60KXIwIjD/Sjk1
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan