smokeloader | e051e630d779620dfe52e68e157f38a6b2f97f66b6136a8e75bf02634a5a65b9 | Triage

Sharing

General

Target

e051e630d779620dfe52e68e157f38a6b2f97f66b6136a8e75bf02634a5a65b9
Size

198KB
Sample

230310-y3azaafc22
MD5

5bc1774ebeca1525058ae1501e5e11c7
SHA1

7a51999683bc1d9388925479d890d1037ac6c6cb
SHA256

e051e630d779620dfe52e68e157f38a6b2f97f66b6136a8e75bf02634a5a65b9
SHA512

5631bce54e0d97724d94266baf768d4b5bf91821d354660feb3e5813407eb3895151764dc7303fe2db4539c152f6592859226d271f0f3a1067f1dbeeb56df1e4
SSDEEP

3072:1vHtFqxDMYWC70ckqrWV4q4vNJ3j3f0MzY8/POtmcgldD1ywW:9NFMgYYk24qINJ3zNY83OMzdw

Score

10^/10

smokeloader sprg backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

rc4.i32

Targets

- Target
  
  e051e630d779620dfe52e68e157f38a6b2f97f66b6136a8e75bf02634a5a65b9
- Size
  
  198KB
- MD5
  
  5bc1774ebeca1525058ae1501e5e11c7
- SHA1
  
  7a51999683bc1d9388925479d890d1037ac6c6cb
- SHA256
  
  e051e630d779620dfe52e68e157f38a6b2f97f66b6136a8e75bf02634a5a65b9
- SHA512
  
  5631bce54e0d97724d94266baf768d4b5bf91821d354660feb3e5813407eb3895151764dc7303fe2db4539c152f6592859226d271f0f3a1067f1dbeeb56df1e4
- SSDEEP
  
  3072:1vHtFqxDMYWC70ckqrWV4q4vNJ3j3f0MzY8/POtmcgldD1ywW:9NFMgYYk24qINJ3zNY83OMzdw
Score

10^/10

smokeloader sprg backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloadersprgbackdoortrojan