smokeloader

General

Target

ef907dbbf7cdbc68d1c492447bf8479714e812edfa34ec6415fe767a4f3ab703
Size

193KB
Sample

221203-w75ncahh5s
MD5

6ea1e86604ea9deeb6d34657dce3b18c
SHA1

17bf58e60f697f3d006dba1edc9afe242576cb07
SHA256

7686a1f258210ccbfd8b680a54d3ee386630cacb32e5b902242fb851033165b4
SHA512

c26bd600495dca8e631887d193566b5b17b85f82cda35b269f50f0a7674f9b0be5d8a515e3829b8036a5e8f12359170d907d0e817617512599f2aad81f249e00
SSDEEP

3072:XadluFYEvoq4Uhq3gBmp5/oT5/FTfQd5Y6BQFxliA8M/mbYc6r3/j3+6CFN:qdlErx5BWi59TAPBYl2Zd6v+nFN

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

56

Botnet

1148

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

Attributes

profile_id
1148

Targets

- Target
  
  ef907dbbf7cdbc68d1c492447bf8479714e812edfa34ec6415fe767a4f3ab703
- Size
  
  351KB
- MD5
  
  53b26d54fb8b4bbeb3412733b9b4eb8e
- SHA1
  
  fd3c0b834bc23328a1ba35e6550e0115d2fc11db
- SHA256
  
  ef907dbbf7cdbc68d1c492447bf8479714e812edfa34ec6415fe767a4f3ab703
- SHA512
  
  b9cfa6af47830dda843bc4cc27ed6a96b7128374fdc332e151c0f85923517305973add59f71764826ca69f1637e7f150d4ea5e02b1158d324006d2f6b7b09830
- SSDEEP
  
  6144:7VXZAjepe90OPXTAx3CtnMW2RqnZDQtrY:7VpAjseqOPw3EMW3+FY
Score

10^/10

smokeloader backdoor trojan vidar 1148 discovery spyware stealer
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2