smokeloader | de9aa15039e11c60fec2922eb6ea2027abd5b2259fdf89d0bae6c48f0c090c2f | Triage™

Login
Reports

Overview

overview

Static

static

3

2026-04-09...da.exe

windows10-2004-x64

2026-04-09...da.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
Size 4.1MB
Sample260409-tcp83aew3j
SHA256 de9aa15039e11c60fec2922eb6ea2027abd5b2259fdf89d0bae6c48f0c090c2f
MD5 8d2da4b793a84d8478d5e3ea3ccded70
SHA1 add06bc81e792d9bf44db335e3661a76b6c0ec34
SHA512 9dc1266bc3a171679b24236c1e3dfd7cdcdad945f2378755cea71e1ad2e0d9c67fb86acf47fda80a1ab168e7f12c5ab4de1239056b04b42525f4811aa3856b65
SSDEEP 49152:vj7EVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtFl7:PfnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
TLSH
T1ED168C13EBC25AE5F68D05365B540200E73AEA51A64F1361306C226DDFE73878FA5A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

smokeloader lab backdoor discovery persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhada.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

13 signatures

150 seconds

backdoor lab discovery smokeloader persistence trojan

Behavioral task

behavioral2

Sample

2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhada.exe

Resource

win11-20260130-en

windows11-21h2-x64

13 signatures

150 seconds

backdoor lab discovery smokeloader persistence trojan

Malware Config

Extracted

Family

smokeloader

Botnet

lab

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/
http://host-host-file8.com/

rc4.i32

rc4.i32

Targets

- Target
  2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
- Size 4.1MB
- SHA256 de9aa15039e11c60fec2922eb6ea2027abd5b2259fdf89d0bae6c48f0c090c2f
- MD5 8d2da4b793a84d8478d5e3ea3ccded70
- SHA1 add06bc81e792d9bf44db335e3661a76b6c0ec34
- SHA512 9dc1266bc3a171679b24236c1e3dfd7cdcdad945f2378755cea71e1ad2e0d9c67fb86acf47fda80a1ab168e7f12c5ab4de1239056b04b42525f4811aa3856b65
- SSDEEP 49152:vj7EVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtFl7:PfnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
- TLSH
  T1ED168C13EBC25AE5F68D05365B540200E73AEA51A64F1361306C226DDFE73878FA5A3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor lab discovery smokeloader persistence trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

backdoorlabdiscoverysmokeloaderpersistencetrojan

behavioral2

backdoorlabdiscoverysmokeloaderpersistencetrojan

© 2018-2026

Terms | Privacy