Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.
Not cited by any technique.
None recorded.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1027.013 Encrypted/Encoded File |
MalwareSmoke Loader | Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware. |
| T1053.005 Scheduled Task |
MalwareSmoke Loader | Smoke Loader launches a scheduled task. |
| T1055 Process Injection |
MalwareSmoke Loader | Smoke Loader injects into the Internet Explorer process. |
| T1083 File and Directory Discovery |
MalwareSmoke Loader | Smoke Loader recursively searches through directories for files. |
| T1114.001 Local Email Collection |
MalwareSmoke Loader | Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.). |
| T1140 Deobfuscate/Decode Files or Information |
MalwareSmoke Loader | Smoke Loader deobfuscates its code. |
| T1497.001 System Checks |
MalwareSmoke Loader | Smoke Loader scans processes to perform anti-VM checks. |
| T1552.001 Credentials In Files |
MalwareSmoke Loader | Smoke Loader searches for files named logins.json to parse for credentials. |
| T1555.003 Credentials from Web Browsers |
MalwareSmoke Loader | Smoke Loader searches for credentials stored from web browsers. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
