smokeloader | 1371f17b73bc5759c00aede9528566ae152a44b63b417f815a2a1a4eb891ba0b | Triage

Sharing

General

Target

41e4255c07c98a6273e14a0a895a0976193832f5e00acfc0c33f219364554a9c.zip
Size

138KB
Sample

250212-18c2yazkhy
MD5

29863165017a9f817a092a4fa76d0733
SHA1

367c8abf9c83d4d32c15c562f0c6f650551e8e53
SHA256

1371f17b73bc5759c00aede9528566ae152a44b63b417f815a2a1a4eb891ba0b
SHA512

5696876d3392978fed8bd47f233ac1fc69d9b9d7b74976d6c8d902f2ea7fa0b849dff7b1a43c916673c23484fe275112ea06728f1c8217a28fabc558644cf9e9
SSDEEP

3072:uAFWFgWbJrvITXwj2CF+HfMnLh8+ZmxSgpzIIgob6l+R:u7FPbBvyE1+H22qeZIIgz4R

Score

10^/10

smokeloader lab backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

lab

Targets

- Target
  
  41e4255c07c98a6273e14a0a895a0976193832f5e00acfc0c33f219364554a9c.exe
- Size
  
  194KB
- MD5
  
  62d3e762e57c4dce4d033ee555931b02
- SHA1
  
  f2c83b14a5549ef564ce4718c711aea42dbcc1f4
- SHA256
  
  41e4255c07c98a6273e14a0a895a0976193832f5e00acfc0c33f219364554a9c
- SHA512
  
  b3a70474ae55e99265ce38f66dd87aec9af6d66c51bcaab0705f2bf9977866fc46d2da7764b159587ae47bedd0ac4d4f4b2aaade5199af7277ae9222ccc21f6e
- SSDEEP
  
  3072:8BN4X312UloP0BmLhjEmBE5OOQkS1vdj0L59Xhzz1w2/R9qOIcWNbsUTJKdV:0mEP0oLhwmBAw2lJV1QOIcQb7Ju
Score

10^/10

smokeloader lab backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderlabbackdoordiscoverytrojan

behavioral2

smokeloaderlabbackdoordiscoverytrojan