smokeloader | 35c1eb5ff8913c4ca4feb712e05354772146247bdb4b337868c687730f201023 | Triage

Submit
Reports

Overview

overview

Static

static

1

35c1eb5ff8...023.js

windows7-x64

6

35c1eb5ff8...023.js

windows10-2004-x64

Sharing

General

Target

35c1eb5ff8913c4ca4feb712e05354772146247bdb4b337868c687730f201023.js
Size

16KB
Sample

250206-g28qgsxnhq
MD5

176c3de6c4a1ac5c34b6d6be54fca774
SHA1

73efc19941b9341f7735a616888b4f306b4815eb
SHA256

35c1eb5ff8913c4ca4feb712e05354772146247bdb4b337868c687730f201023
SHA512

fa72ece6c653565da20dfa3a530b5a5b537e84675fba4f86ac3429aac075951838e31e6b968ee9c493ea3663b1eafa5f0076e6e445b04415258f1409910c3789
SSDEEP

384:kmEPupCtEbRpMDRttoR/eRQRnR0YmRrVBhrpOJ9/awXJ1XIHN1w2/tptXvERR7FM:kmEPupCtEbRpMDRttoR/eRQRnR0YmRrr

Score

10^/10

smokeloader backdoor discovery execution trojan

Static task

static1

Behavioral task

behavioral1

Sample

35c1eb5ff8913c4ca4feb712e05354772146247bdb4b337868c687730f201023.js

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

35c1eb5ff8913c4ca4feb712e05354772146247bdb4b337868c687730f201023.js

Resource

win10v2004-20250129-en

smokeloader backdoor discovery execution trojan

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  35c1eb5ff8913c4ca4feb712e05354772146247bdb4b337868c687730f201023.js
- Size
  
  16KB
- MD5
  
  176c3de6c4a1ac5c34b6d6be54fca774
- SHA1
  
  73efc19941b9341f7735a616888b4f306b4815eb
- SHA256
  
  35c1eb5ff8913c4ca4feb712e05354772146247bdb4b337868c687730f201023
- SHA512
  
  fa72ece6c653565da20dfa3a530b5a5b537e84675fba4f86ac3429aac075951838e31e6b968ee9c493ea3663b1eafa5f0076e6e445b04415258f1409910c3789
- SSDEEP
  
  384:kmEPupCtEbRpMDRttoR/eRQRnR0YmRrVBhrpOJ9/awXJ1XIHN1w2/tptXvERR7FM:kmEPupCtEbRpMDRttoR/eRQRnR0YmRrr
Score

10^/10

execution smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

smokeloaderbackdoordiscoveryexecutiontrojan

© 2018-2025

Terms | Privacy