smokeloader

General

Target

a3e304b780bbaa3ebb22a29a2d21c671f54ab5a266edb5aa92245b700430c680
Size

342KB
Sample

221204-pmv5vadb2z
MD5

93d4136dad69e7326c166d6b95c82660
SHA1

51a73f461a7fee586d5fb882d5ea8fab9b5f80e9
SHA256

a3e304b780bbaa3ebb22a29a2d21c671f54ab5a266edb5aa92245b700430c680
SHA512

d6598d8fc4d17523380d62239223a68b8bc2d3173212d6af69aaa080fb08aef9b0876987802ab16fc96ccc9c13f2d362b6eb7823d56bd0636dda72f1da552af6
SSDEEP

3072:J1lqEa4zi3LLs55oULwkRBazd4gerFZxDv2c3OviRqQx8AcLymlAjTI+TjuE+EtW:nbziv8oIwd4zvKc3cdakymlglFQG1PZ

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

56

Botnet

1148

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

Attributes

profile_id
1148

Targets

- Target
  
  a3e304b780bbaa3ebb22a29a2d21c671f54ab5a266edb5aa92245b700430c680
- Size
  
  342KB
- MD5
  
  93d4136dad69e7326c166d6b95c82660
- SHA1
  
  51a73f461a7fee586d5fb882d5ea8fab9b5f80e9
- SHA256
  
  a3e304b780bbaa3ebb22a29a2d21c671f54ab5a266edb5aa92245b700430c680
- SHA512
  
  d6598d8fc4d17523380d62239223a68b8bc2d3173212d6af69aaa080fb08aef9b0876987802ab16fc96ccc9c13f2d362b6eb7823d56bd0636dda72f1da552af6
- SSDEEP
  
  3072:J1lqEa4zi3LLs55oULwkRBazd4gerFZxDv2c3OviRqQx8AcLymlAjTI+TjuE+EtW:nbziv8oIwd4zvKc3cdakymlglFQG1PZ
Score

10^/10

smokeloader vidar 1148 backdoor discovery spyware stealer trojan
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1