smokeloader

General

Target

setup.exe
Size

276KB
Sample

230325-ck49hscg4t
MD5

c579c917e1193bb0d9caeb9a25a0346a
SHA1

3a9f68a29953b0efee797553a8cd89302c0247a4
SHA256

079b674d7463e18b51a879894fb56754ba0b425c9b2d7bb9265a37a3b59230eb
SHA512

62bd88470d44eef8c427b1988f5cc41641fb2c171a2e88feaf35bdbbf183aa99ca979f726cf6243e6ab5a57d948339f96f26ac636bf137e3c5b874d0006674b3
SSDEEP

3072:zxkf182x6t4Ci95kwUlfCjmg4dZKtl3iz4Zl4tlmo9ZSSH3T20qWN8aeeL:Fw+HkYfCjHsz4H01T20qva

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Targets

- Target
  
  setup.exe
- Size
  
  276KB
- MD5
  
  c579c917e1193bb0d9caeb9a25a0346a
- SHA1
  
  3a9f68a29953b0efee797553a8cd89302c0247a4
- SHA256
  
  079b674d7463e18b51a879894fb56754ba0b425c9b2d7bb9265a37a3b59230eb
- SHA512
  
  62bd88470d44eef8c427b1988f5cc41641fb2c171a2e88feaf35bdbbf183aa99ca979f726cf6243e6ab5a57d948339f96f26ac636bf137e3c5b874d0006674b3
- SSDEEP
  
  3072:zxkf182x6t4Ci95kwUlfCjmg4dZKtl3iz4Zl4tlmo9ZSSH3T20qWN8aeeL:Fw+HkYfCjHsz4H01T20qva
Score

10^/10

smokeloader sprg backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2