smokeloader | aff0d7c63d9f54d6c899c45d36ca69449dcb66d084595dc3b730b2f0c2bb6cf0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aff0d7c63d9f54d6c899c45d36ca69449dcb66d084595dc3b730b2f0c2bb6cf0
Size

262KB
Sample

230321-m5akrabh6t
MD5

e2572333d883806e24435b137052bdca
SHA1

ee38c8e82998188a9d6186510282a106b889bd3c
SHA256

aff0d7c63d9f54d6c899c45d36ca69449dcb66d084595dc3b730b2f0c2bb6cf0
SHA512

2d35732cf895db8286090e95a8a7323920dfe27a6c0601d506f0f7df8eaa81157bbea02dde4dceb00208b3d55edc4697f2b3c1a4f2feb645fd896ce12bad2ed8
SSDEEP

6144:gfyLNiD7qAV2lWSaKOdpI/Nofpof0LT9c:gfyIXqAV2lTLHN4i8F

Score

10^/10

smokeloader sprg backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

rc4.i32

Targets

- Target
  
  aff0d7c63d9f54d6c899c45d36ca69449dcb66d084595dc3b730b2f0c2bb6cf0
- Size
  
  262KB
- MD5
  
  e2572333d883806e24435b137052bdca
- SHA1
  
  ee38c8e82998188a9d6186510282a106b889bd3c
- SHA256
  
  aff0d7c63d9f54d6c899c45d36ca69449dcb66d084595dc3b730b2f0c2bb6cf0
- SHA512
  
  2d35732cf895db8286090e95a8a7323920dfe27a6c0601d506f0f7df8eaa81157bbea02dde4dceb00208b3d55edc4697f2b3c1a4f2feb645fd896ce12bad2ed8
- SSDEEP
  
  6144:gfyLNiD7qAV2lWSaKOdpI/Nofpof0LT9c:gfyIXqAV2lTLHN4i8F
Score

10^/10

smokeloader sprg backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloadersprgbackdoortrojan