smokeloader | 04858388ff1fd23042bbf431e7c765125f633660f4f43c9a92d096f581dd8192 | Triage

Sharing

General

Target

2025-03-29_3542bbafc4eca6664ff23e4c13f7bdc3_amadey_smoke-loader
Size

19.2MB
Sample

250329-qsqmzstzgv
MD5

3542bbafc4eca6664ff23e4c13f7bdc3
SHA1

85f84f36456b7924621cd3c150deb0c4f5df8274
SHA256

04858388ff1fd23042bbf431e7c765125f633660f4f43c9a92d096f581dd8192
SHA512

630a4157687260456984a96e29a0f84ca7eb7661f0474034cccf5b119b5bc6ac5e89e78c453d3d2ef8c6bde82ac9d25cda88fb3fd7c303fb3b3d6df29a0b7917
SSDEEP

6144:Ka8mjmVQcEzGBPoSUmGWMBCpoiJZVE5Vskrbt:nXjDc4wPoSnGWMBIoipE52k

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Targets

- Target
  
  2025-03-29_3542bbafc4eca6664ff23e4c13f7bdc3_amadey_smoke-loader
- Size
  
  19.2MB
- MD5
  
  3542bbafc4eca6664ff23e4c13f7bdc3
- SHA1
  
  85f84f36456b7924621cd3c150deb0c4f5df8274
- SHA256
  
  04858388ff1fd23042bbf431e7c765125f633660f4f43c9a92d096f581dd8192
- SHA512
  
  630a4157687260456984a96e29a0f84ca7eb7661f0474034cccf5b119b5bc6ac5e89e78c453d3d2ef8c6bde82ac9d25cda88fb3fd7c303fb3b3d6df29a0b7917
- SSDEEP
  
  6144:Ka8mjmVQcEzGBPoSUmGWMBCpoiJZVE5Vskrbt:nXjDc4wPoSnGWMBIoipE52k
Score

10^/10

smokeloader backdoor discovery trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoordiscoverytrojan

behavioral2

smokeloaderbackdoordiscoverytrojan