smokeloader | 4e4679c3a8fe7e7e2041945ccd7172e3b3722b38c614e07d48d29700312abdd3 | Triage

Sharing

General

Target

4e4679c3a8fe7e7e2041945ccd7172e3b3722b38c614e07d48d29700312abdd3
Size

342KB
Sample

221204-ggzxvaff81
MD5

34f2030cc003ede5a81fb807cdf393e1
SHA1

b406c5cbc9e2d5b5a4b944a60751c35126eaadb8
SHA256

4e4679c3a8fe7e7e2041945ccd7172e3b3722b38c614e07d48d29700312abdd3
SHA512

2a8036caf46bdf96fdd1780e5cd9c03140f291e4736ec34f69845272643bca951726fe8ec94af80057e7b78c140f818bdd9e23250257a76df34da1419426ffc0
SSDEEP

6144:EioRFuaxgWvhfs/WdbWajWnMW2Rqnm+RXUQYq:EioRFcMhfs/WV0MW3m+RUQY

Score

10^/10

smokeloader vidar 1148 backdoor stealer trojan

Malware Config

Extracted

Family

vidar

Version

56

Botnet

1148

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

Attributes

profile_id
1148

Targets

- Target
  
  4e4679c3a8fe7e7e2041945ccd7172e3b3722b38c614e07d48d29700312abdd3
- Size
  
  342KB
- MD5
  
  34f2030cc003ede5a81fb807cdf393e1
- SHA1
  
  b406c5cbc9e2d5b5a4b944a60751c35126eaadb8
- SHA256
  
  4e4679c3a8fe7e7e2041945ccd7172e3b3722b38c614e07d48d29700312abdd3
- SHA512
  
  2a8036caf46bdf96fdd1780e5cd9c03140f291e4736ec34f69845272643bca951726fe8ec94af80057e7b78c140f818bdd9e23250257a76df34da1419426ffc0
- SSDEEP
  
  6144:EioRFuaxgWvhfs/WdbWajWnMW2Rqnm+RXUQYq:EioRFcMhfs/WV0MW3m+RUQY
Score

10^/10

smokeloader vidar 1148 backdoor stealer trojan
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Uses the VBS compiler for execution
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

smokeloadervidar1148backdoorstealertrojan