smokeloader | 20aa1941a8c5639c7561516c39938ed769ac4716d822fdf3393e4fe09bc83f69 | Triage

Sharing

General

Target

20aa1941a8c5639c7561516c39938ed769ac4716d822fdf3393e4fe09bc83f69
Size

191KB
Sample

230312-yv9smshd2v
MD5

25709f904617ff9ba8e9f9cc22d8edee
SHA1

efedbfc5ae18c5d69a41468767b02132ed421946
SHA256

20aa1941a8c5639c7561516c39938ed769ac4716d822fdf3393e4fe09bc83f69
SHA512

de1803e8ff2d82241aca69230f7ecbf326f15514e3a09e006065a134de12cd28f7aa58005c3d1580ce3865ea03d70153967f36558747afef96278d3299fcee3d
SSDEEP

3072:y8jc1J6tUFOJbW4ZQuZgY2jMcXG9hhcWJ7+TKVC0JX60bUv/:tI1YtUItOo9vd9QO7wICmJb

Score

10^/10

smokeloader sprg backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

rc4.i32

Targets

- Target
  
  20aa1941a8c5639c7561516c39938ed769ac4716d822fdf3393e4fe09bc83f69
- Size
  
  191KB
- MD5
  
  25709f904617ff9ba8e9f9cc22d8edee
- SHA1
  
  efedbfc5ae18c5d69a41468767b02132ed421946
- SHA256
  
  20aa1941a8c5639c7561516c39938ed769ac4716d822fdf3393e4fe09bc83f69
- SHA512
  
  de1803e8ff2d82241aca69230f7ecbf326f15514e3a09e006065a134de12cd28f7aa58005c3d1580ce3865ea03d70153967f36558747afef96278d3299fcee3d
- SSDEEP
  
  3072:y8jc1J6tUFOJbW4ZQuZgY2jMcXG9hhcWJ7+TKVC0JX60bUv/:tI1YtUItOo9vd9QO7wICmJb
Score

10^/10

smokeloader sprg backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloadersprgbackdoortrojan