smokeloader

General

Target

setup.exe
Size

273KB
Sample

230326-bhs8sseh87
MD5

5d94d7efb94c90808f3d17e4665c7734
SHA1

b33c42a804ed9208ee457ea466119b8fa8b0e24d
SHA256

a1409f24e40fb5a5f190d68d237cfa5bb343e3796902dd09a5cce202a681f2c8
SHA512

c44cc01c9e9fb627e717075e852c41892ea8b248c729ee5d7fbdc9a5435d8999ef1b97f7c77ed5a421134328a7eeca7fc0e49b4aa2acdd0ab00acc5fa9d64c39
SSDEEP

3072:Cm8s08r4RtqubALv2po58+SMprhseGzPFQt8zd6U5OrpNCJQN0fm2Rh:SttqKe58+uxQyB6cOuTfz

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Targets

- Target
  
  setup.exe
- Size
  
  273KB
- MD5
  
  5d94d7efb94c90808f3d17e4665c7734
- SHA1
  
  b33c42a804ed9208ee457ea466119b8fa8b0e24d
- SHA256
  
  a1409f24e40fb5a5f190d68d237cfa5bb343e3796902dd09a5cce202a681f2c8
- SHA512
  
  c44cc01c9e9fb627e717075e852c41892ea8b248c729ee5d7fbdc9a5435d8999ef1b97f7c77ed5a421134328a7eeca7fc0e49b4aa2acdd0ab00acc5fa9d64c39
- SSDEEP
  
  3072:Cm8s08r4RtqubALv2po58+SMprhseGzPFQt8zd6U5OrpNCJQN0fm2Rh:SttqKe58+uxQyB6cOuTfz
Score

10^/10

smokeloader sprg backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2