smokeloader

General

Target
file.exe
Size 360KB
Sample230322-xd26ssce8t
SHA256 d6b06f7b07cd71f55091d9d1c36556538dfe3fd8cd3b40bccd29d6ea123fb334
MD5 39301482aa35c5dad8e6fab842109cca
SHA1 917092a21b22f6e11f932b176e93b536e84a4130
SHA512 eb97b3993f034da0346bccc15b604e716ac730ebadfcc4a92b292853d7c03afd650671c647f815bae19527027b7814669c0cdf1874c3a12d4fc652b37ddb4b4a
SSDEEP 3072:KXsF7PoVHsPM2jXO2N1BDeZ7fGIKhggw4m8qPjGDe53RUoV:GMq2v+TGZgu+yDe53q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/

rc4.i32

Targets

- Target
  file.exe
- Size 360KB
- SHA256 d6b06f7b07cd71f55091d9d1c36556538dfe3fd8cd3b40bccd29d6ea123fb334
- MD5 39301482aa35c5dad8e6fab842109cca
- SHA1 917092a21b22f6e11f932b176e93b536e84a4130
- SHA512 eb97b3993f034da0346bccc15b604e716ac730ebadfcc4a92b292853d7c03afd650671c647f815bae19527027b7814669c0cdf1874c3a12d4fc652b37ddb4b4a
- SSDEEP 3072:KXsF7PoVHsPM2jXO2N1BDeZ7fGIKhggw4m8qPjGDe53RUoV:GMq2v+TGZgu+yDe53q
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader pub4 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2