smokeloader

General

Target

KSMIXTWO.file
Size

218KB
Sample

230627-n5r1gaeh3v
MD5

3fb539ea9dbcfdfac4ecd7376922d5b0
SHA1

9664662e481b5f2422734debd157767d37faea52
SHA256

cc972f18e2f649cb4c8de3d5dea102616cc95ec23ff1301d7d0d35beab7bd0bc
SHA512

2b35491130180c852e6d80d073dd00fa45c7fbf42ef42e03c3497fda04c3bddba74d021cd58d5bd0c3bbeaa93e299ddf2a456d4743bc53e371f0aa5ef0404730
SSDEEP

3072:xk2bU28gD+vM/59zVPIqtn8say5UOHVyk+XWDbaJ8tBRfaAsf7P5BSc:xjbagKIzVAoZayzHtnaJ83RfaDf7vSc

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Targets

- Target
  
  KSMIXTWO.file
- Size
  
  218KB
- MD5
  
  3fb539ea9dbcfdfac4ecd7376922d5b0
- SHA1
  
  9664662e481b5f2422734debd157767d37faea52
- SHA256
  
  cc972f18e2f649cb4c8de3d5dea102616cc95ec23ff1301d7d0d35beab7bd0bc
- SHA512
  
  2b35491130180c852e6d80d073dd00fa45c7fbf42ef42e03c3497fda04c3bddba74d021cd58d5bd0c3bbeaa93e299ddf2a456d4743bc53e371f0aa5ef0404730
- SSDEEP
  
  3072:xk2bU28gD+vM/59zVPIqtn8say5UOHVyk+XWDbaJ8tBRfaAsf7P5BSc:xjbagKIzVAoZayzHtnaJ83RfaDf7vSc
Score

10^/10

smokeloader pub4 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2