smokeloader | 83f3f12292ff0d3b984bbee89e0cc60bcc3df6012a21679ca94ae6ee5d053907 | Triage

Sharing

General

Target

JaffaCakes118_b9efaee6f75d6ddccb6740485fbf818c
Size

233KB
Sample

250109-dapazsvmfz
MD5

b9efaee6f75d6ddccb6740485fbf818c
SHA1

31836605ccb35a4ec4f9477a449ffe493df486eb
SHA256

83f3f12292ff0d3b984bbee89e0cc60bcc3df6012a21679ca94ae6ee5d053907
SHA512

ce81a6b8134e6e3d28b8b306776262f9902d36662ef375eac0392bfc5aa794b682d2b3f441ceb502514c3f952ed6ca7108fc801accf907a5bafa0a003b656a5f
SSDEEP

3072:RGB6tEhjUnUUlq1Qwfu6Lsw71Pxlr1iPNTFgz+CNf4/AWaSkSJu98vd2:ehjUnUUeQwJAqBL1iPNT+TIADG8el2

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_b9efaee6f75d6ddccb6740485fbf818c
- Size
  
  233KB
- MD5
  
  b9efaee6f75d6ddccb6740485fbf818c
- SHA1
  
  31836605ccb35a4ec4f9477a449ffe493df486eb
- SHA256
  
  83f3f12292ff0d3b984bbee89e0cc60bcc3df6012a21679ca94ae6ee5d053907
- SHA512
  
  ce81a6b8134e6e3d28b8b306776262f9902d36662ef375eac0392bfc5aa794b682d2b3f441ceb502514c3f952ed6ca7108fc801accf907a5bafa0a003b656a5f
- SSDEEP
  
  3072:RGB6tEhjUnUUlq1Qwfu6Lsw71Pxlr1iPNTFgz+CNf4/AWaSkSJu98vd2:ehjUnUUeQwJAqBL1iPNT+TIADG8el2
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan