smokeloader | 01d8b72fe274db94e38ef8f73ea6017e5e3efdfd0c4178958bd7f24709a4131a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01d8b72fe274db94e38ef8f73ea6017e5e3efdfd0c4178958bd7f24709a4131a
Size

319KB
Sample

230504-s9an7sde32
MD5

5e84abca1e3d71b6ae5b12c7d6af2ef0
SHA1

ce79e3d3ef02a68e94335992ddf1d1318c64e98b
SHA256

01d8b72fe274db94e38ef8f73ea6017e5e3efdfd0c4178958bd7f24709a4131a
SHA512

bf5e8b3aff747dc81cd8f2a961233f96e1c1407299dfc949525c2953fcf87eb8bcc1b6024aabb4bb2268044f033597f03200830fe9eb6848067e26f3bc2b18a9
SSDEEP

3072:gNQ6c4rbCS6r35fQMSpc97dCkITw+ouG2Hh1TQQ0WfWByfn5he4UaOdx//t:R6LrU3mMS0hCTk+Q2Hh1sLVqhst

Score

10^/10

smokeloader sprg backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

rc4.i32

Targets

- Target
  
  01d8b72fe274db94e38ef8f73ea6017e5e3efdfd0c4178958bd7f24709a4131a
- Size
  
  319KB
- MD5
  
  5e84abca1e3d71b6ae5b12c7d6af2ef0
- SHA1
  
  ce79e3d3ef02a68e94335992ddf1d1318c64e98b
- SHA256
  
  01d8b72fe274db94e38ef8f73ea6017e5e3efdfd0c4178958bd7f24709a4131a
- SHA512
  
  bf5e8b3aff747dc81cd8f2a961233f96e1c1407299dfc949525c2953fcf87eb8bcc1b6024aabb4bb2268044f033597f03200830fe9eb6848067e26f3bc2b18a9
- SSDEEP
  
  3072:gNQ6c4rbCS6r35fQMSpc97dCkITw+ouG2Hh1TQQ0WfWByfn5he4UaOdx//t:R6LrU3mMS0hCTk+Q2Hh1sLVqhst
Score

10^/10

smokeloader sprg backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloadersprgbackdoortrojan