smokeloader

General

Target
SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.32288.31536.exe
Size 267KB
Sample230915-1hlldsab49
SHA256 7a3ed98aad8f0e6cc774200cdc7b35b86bffdb5f5ce23e8750acb0945d3c78fd
MD5 a40f5d4fa7c449ca99ffe9191ef03988
SHA1 1ecb44d3f7b583463785ba03e57c85d6f452f98e
SHA512 c60aa310ee7f5ca87f4b17375da8c18314b26307a131cf0ea0548caabc760b2d30d83c26742f10a1588a92a840365f54cfd5833deb529275de4403cf8be50822
SSDEEP 6144:QqN+ovUltzqjf2ld/OdtHnhGrJCfH+XQ:QD4UHzU8IHhuoi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/
http://host-host-file8.com/

rc4.i32

Targets

- Target
  SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.32288.31536.exe
- Size 267KB
- SHA256 7a3ed98aad8f0e6cc774200cdc7b35b86bffdb5f5ce23e8750acb0945d3c78fd
- MD5 a40f5d4fa7c449ca99ffe9191ef03988
- SHA1 1ecb44d3f7b583463785ba03e57c85d6f452f98e
- SHA512 c60aa310ee7f5ca87f4b17375da8c18314b26307a131cf0ea0548caabc760b2d30d83c26742f10a1588a92a840365f54cfd5833deb529275de4403cf8be50822
- SSDEEP 6144:QqN+ovUltzqjf2ld/OdtHnhGrJCfH+XQ:QD4UHzU8IHhuoi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader up3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2