smokeloader | b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027.exe
Size

241KB
Sample

230613-bhjpcseh3w
MD5

7d726c8be35f9e9f010363c050ee86b3
SHA1

13d73cea5b8d05b338f347cdfc4088cc4f38fcac
SHA256

b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027
SHA512

a99fd000bf852276d2722e7e75b9577dbac669a12c7db9e52965808aabc7710bfa3956de993f14154143db45ad124f4ed90255332171bb4df57c30707e0a042b
SSDEEP

3072:O98WPLTgdxkBH8ZQYTr6DQ6v+UT4i0JKIMuFes7P:XWzcdxkFhCwQC8bMuF

Score

10^/10

smokeloader summ backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

summ

Extracted

Family

smokeloader

Version

2022

C2

http://stalagmijesarl.com/

http://ukdantist-sarl.com/

http://cpcorprotationltd.com/

rc4.i32

rc4.i32

Targets

- Target
  
  b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027.exe
- Size
  
  241KB
- MD5
  
  7d726c8be35f9e9f010363c050ee86b3
- SHA1
  
  13d73cea5b8d05b338f347cdfc4088cc4f38fcac
- SHA256
  
  b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027
- SHA512
  
  a99fd000bf852276d2722e7e75b9577dbac669a12c7db9e52965808aabc7710bfa3956de993f14154143db45ad124f4ed90255332171bb4df57c30707e0a042b
- SSDEEP
  
  3072:O98WPLTgdxkBH8ZQYTr6DQ6v+UT4i0JKIMuFes7P:XWzcdxkFhCwQC8bMuF
Score

10^/10

smokeloader summ backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloadersummbackdoortrojan

behavioral2

smokeloadersummbackdoortrojan