smokeloader

General

Target

2d90e4d6aabf27b3e3babbb6846ed261f650f885858be57a2def6a5e361071b7
Size

281KB
Sample

230903-1ttfdacc4z
MD5

4dc922beacbbd78690a084e451fe420e
SHA1

60dad60b5c7302b4e3710178adc3e3733a969feb
SHA256

2d90e4d6aabf27b3e3babbb6846ed261f650f885858be57a2def6a5e361071b7
SHA512

9f794fecd0557ca9aad0eedf6c463620657c64033478fa518e195ddfa0d0ae17c91bf3857e362309ecf8ffba54a74b1107d59b16c75cca686a65987000363a81
SSDEEP

3072:/aD8DiZ7URsbW4FC0iK/qEB21CgE8bNUT51RMPU5Lt0Fyeymx:yP7w3Xk0CgEcNU5fMc54yey

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

smokeloader

Version

2022

C2

http://taibi.at/tmp/

http://01stroy.ru/tmp/

http://mal-net.com/tmp/

http://gromograd.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Targets

- Target
  
  2d90e4d6aabf27b3e3babbb6846ed261f650f885858be57a2def6a5e361071b7
- Size
  
  281KB
- MD5
  
  4dc922beacbbd78690a084e451fe420e
- SHA1
  
  60dad60b5c7302b4e3710178adc3e3733a969feb
- SHA256
  
  2d90e4d6aabf27b3e3babbb6846ed261f650f885858be57a2def6a5e361071b7
- SHA512
  
  9f794fecd0557ca9aad0eedf6c463620657c64033478fa518e195ddfa0d0ae17c91bf3857e362309ecf8ffba54a74b1107d59b16c75cca686a65987000363a81
- SSDEEP
  
  3072:/aD8DiZ7URsbW4FC0iK/qEB21CgE8bNUT51RMPU5Lt0Fyeymx:yP7w3Xk0CgEcNU5fMc54yey
Score

10^/10

smokeloader pub5 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2