smokeloader | 55342cc557701dfbc6f8d2502b16a8040cd4f969b8698797749623393388e22e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

55342cc557701dfbc6f8d2502b16a8040cd4f969b8698797749623393388e22e
Size

317KB
Sample

230504-1pbprsfd37
MD5

88ce0d37d24d4315a02dba5fdb770206
SHA1

d118085e73cd1ba1dbbcd4d396eb95fc19dd54bf
SHA256

55342cc557701dfbc6f8d2502b16a8040cd4f969b8698797749623393388e22e
SHA512

90534ea76e5537ce1548af6cadba98d684d353fc99b52a059231a03f010bf4cab441800fb14cbfeb98064b73accc2a77bc93bd9ac2f802978c5ab71daca44fe7
SSDEEP

3072:HAAwEXfJvSdqmbs3+Ae4gicVoi+JDFD2Y3kjam0L5BE4UKrve2x//t9r/:gA7Xtys3S4B8+JDN2TjamIX5rbt9r/

Score

10^/10

smokeloader sprg backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

rc4.i32

Targets

- Target
  
  55342cc557701dfbc6f8d2502b16a8040cd4f969b8698797749623393388e22e
- Size
  
  317KB
- MD5
  
  88ce0d37d24d4315a02dba5fdb770206
- SHA1
  
  d118085e73cd1ba1dbbcd4d396eb95fc19dd54bf
- SHA256
  
  55342cc557701dfbc6f8d2502b16a8040cd4f969b8698797749623393388e22e
- SHA512
  
  90534ea76e5537ce1548af6cadba98d684d353fc99b52a059231a03f010bf4cab441800fb14cbfeb98064b73accc2a77bc93bd9ac2f802978c5ab71daca44fe7
- SSDEEP
  
  3072:HAAwEXfJvSdqmbs3+Ae4gicVoi+JDFD2Y3kjam0L5BE4UKrve2x//t9r/:gA7Xtys3S4B8+JDN2TjamIX5rbt9r/
Score

10^/10

smokeloader sprg backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloadersprgbackdoortrojan