smokeloader

General

Target
Setup.exe
Size 869KB
Sample260102-kyrjksas2h
SHA256 d5e20fc37dd77dd0360fd32446799978048a2c60e036dbfbf5e671333ebd81f1
MD5 f2b790302bfb0e7f97f36a387eaeb227
SHA1 6d702fe228a47e01198fee387a2baecacac706f8
SHA512 d5e0165389204307ef19cef306c533ea331f24e9d78f5a59b54757cc2707447a1d38ce5f359b18747dad2a5bcef55048847ac27bb54a187583f1694fb2af3ef9
SSDEEP 12288:z+R+rU7N7Jd+Lyh+YkH1dVy4aAvOYxc929L22A5XXCKoSLd4Mb:KRRN71+Ysoo9i2A1X/6Mb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://cobyrose.com/tmp/
http://dfbdw3tyge.info/tmp/
http://cusnick.com/tmp/

rc4.i32

Targets

- Target
  Setup.exe
- Size 869KB
- SHA256 d5e20fc37dd77dd0360fd32446799978048a2c60e036dbfbf5e671333ebd81f1
- MD5 f2b790302bfb0e7f97f36a387eaeb227
- SHA1 6d702fe228a47e01198fee387a2baecacac706f8
- SHA512 d5e0165389204307ef19cef306c533ea331f24e9d78f5a59b54757cc2707447a1d38ce5f359b18747dad2a5bcef55048847ac27bb54a187583f1694fb2af3ef9
- SSDEEP 12288:z+R+rU7N7Jd+Lyh+YkH1dVy4aAvOYxc929L22A5XXCKoSLd4Mb:KRRN71+Ysoo9i2A1X/6Mb
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

backdoor smokeloader persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Smokeloader family

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3