smokeloader

General

Target

file
Size

192KB
Sample

231001-vqwhnscb3t
MD5

d2380cd1655c39e3ded9f95d853e6212
SHA1

ff275594805c683ade31578d0ca8d37869e51b50
SHA256

8a633d717c4509c9c447ec5a237c9b53557622c23d3ffb6e2b8f6bad668cd637
SHA512

0284862e2489c38a04dba24af67c17588e0dbaf722936ec06c005c9e35d03baa6096f3468c66cb5140002eff9e40ff2c73a5106bbd2699f729ea840326abe9fc
SSDEEP

3072:h8X4rJKHc77tp7m2W2E/rqwQG8eOkYAQgSsWe50FScB+ovV:pK877tpBKTqbGAgmBZV

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Targets

- Target
  
  file
- Size
  
  192KB
- MD5
  
  d2380cd1655c39e3ded9f95d853e6212
- SHA1
  
  ff275594805c683ade31578d0ca8d37869e51b50
- SHA256
  
  8a633d717c4509c9c447ec5a237c9b53557622c23d3ffb6e2b8f6bad668cd637
- SHA512
  
  0284862e2489c38a04dba24af67c17588e0dbaf722936ec06c005c9e35d03baa6096f3468c66cb5140002eff9e40ff2c73a5106bbd2699f729ea840326abe9fc
- SSDEEP
  
  3072:h8X4rJKHc77tp7m2W2E/rqwQG8eOkYAQgSsWe50FScB+ovV:pK877tpBKTqbGAgmBZV
Score

10^/10

smokeloader pub4 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Deletes itself
- Drops startup file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Downloads MZ/PE file

Deletes itself

Drops startup file

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2