smokeloader

General

Target

49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9
Size

322KB
Sample

230508-3mfl2sdc73
MD5

f9b1d55654308e893e49ec62c9ea5aa7
SHA1

dd8604a3ff8e6a7fb284cbb703143311b5072dd8
SHA256

49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9
SHA512

000bc79f49c6bea78d807a3adcb3da0366f1ae35c4e5929046e2b05f176d6eda70f7b88a23d51d0b7781b7d406d8eb9bb35c20ffb6d3b539046bb3fb12bda245
SSDEEP

3072:SPapJc+lYWQGGiZaSptQ5Xem0qGsF0doQZC66YrrMWUfN0c9tVtbCaS0GRPma:Si7OQvpS5XeNBLZC66SYRB99i

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Targets

- Target
  
  49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9
- Size
  
  322KB
- MD5
  
  f9b1d55654308e893e49ec62c9ea5aa7
- SHA1
  
  dd8604a3ff8e6a7fb284cbb703143311b5072dd8
- SHA256
  
  49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9
- SHA512
  
  000bc79f49c6bea78d807a3adcb3da0366f1ae35c4e5929046e2b05f176d6eda70f7b88a23d51d0b7781b7d406d8eb9bb35c20ffb6d3b539046bb3fb12bda245
- SSDEEP
  
  3072:SPapJc+lYWQGGiZaSptQ5Xem0qGsF0doQZC66YrrMWUfN0c9tVtbCaS0GRPma:Si7OQvpS5XeNBLZC66SYRB99i
Score

10^/10

smokeloader sprg backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2