smokeloader | fbb99570b341367a86c2c23b56862bfb3d3ea91c06e7c15750f7d36bf82f494b | Triage

Sharing

General

Target

fbb99570b341367a86c2c23b56862bfb3d3ea91c06e7c15750f7d36bf82f494b.exe
Size

284KB
Sample

250213-gbgt3strgz
MD5

7a1362a40d3936ba380649092031a2ba
SHA1

7c6afa09f1d0cce0401d256d19123d0b1edef331
SHA256

fbb99570b341367a86c2c23b56862bfb3d3ea91c06e7c15750f7d36bf82f494b
SHA512

c08a26b343114dc5aae37a1e28dc6d9b7c9c4a503ad8f51eba0005806dee265c5cc8bca2f0b1eef172d5d1437ba55d0ce1d0eb19159bcacaa8b6737b1e9f9d7b
SSDEEP

6144:inr+igK84SPdiuJIlyGDq9gXvJbkF3GoeMIl0CkhJ4OeIMR:6r+igK87vdOaSvBgx41khJ4O7

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  fbb99570b341367a86c2c23b56862bfb3d3ea91c06e7c15750f7d36bf82f494b.exe
- Size
  
  284KB
- MD5
  
  7a1362a40d3936ba380649092031a2ba
- SHA1
  
  7c6afa09f1d0cce0401d256d19123d0b1edef331
- SHA256
  
  fbb99570b341367a86c2c23b56862bfb3d3ea91c06e7c15750f7d36bf82f494b
- SHA512
  
  c08a26b343114dc5aae37a1e28dc6d9b7c9c4a503ad8f51eba0005806dee265c5cc8bca2f0b1eef172d5d1437ba55d0ce1d0eb19159bcacaa8b6737b1e9f9d7b
- SSDEEP
  
  6144:inr+igK84SPdiuJIlyGDq9gXvJbkF3GoeMIl0CkhJ4OeIMR:6r+igK87vdOaSvBgx41khJ4O7
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan