smokeloader

General

Target

3f723542042e51a78beb0e010ba7077c7ad107bd824c34fd30169eb9fcd20bd4
Size

350KB
Sample

221203-yhjqpaea7s
MD5

7de7c205e1139c2458ef359fa0b7b055
SHA1

20c768b0cc31e4a825b6cf4741ea209a0c12cb78
SHA256

3f723542042e51a78beb0e010ba7077c7ad107bd824c34fd30169eb9fcd20bd4
SHA512

adf746c5d1b30863fadb547b336d7771b6f15f55a89f3772612c4c24d583a0ac42fc9f7cc76e52e339b6078cbe5375a3f716372d747cfb6cfdd4f128bab14f87
SSDEEP

6144:XTxqv1iGYkxTOBQNug5QwEj8gnMW2RqnuaYYc:XTSrnJO24XvMW3uaYY

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

56

Botnet

1148

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

Attributes

profile_id
1148

Targets

- Target
  
  3f723542042e51a78beb0e010ba7077c7ad107bd824c34fd30169eb9fcd20bd4
- Size
  
  350KB
- MD5
  
  7de7c205e1139c2458ef359fa0b7b055
- SHA1
  
  20c768b0cc31e4a825b6cf4741ea209a0c12cb78
- SHA256
  
  3f723542042e51a78beb0e010ba7077c7ad107bd824c34fd30169eb9fcd20bd4
- SHA512
  
  adf746c5d1b30863fadb547b336d7771b6f15f55a89f3772612c4c24d583a0ac42fc9f7cc76e52e339b6078cbe5375a3f716372d747cfb6cfdd4f128bab14f87
- SSDEEP
  
  6144:XTxqv1iGYkxTOBQNug5QwEj8gnMW2RqnuaYYc:XTSrnJO24XvMW3uaYY
Score

10^/10

smokeloader vidar 1148 backdoor discovery spyware stealer trojan upx
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Nirsoft
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1