smokeloader | 2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c | Triage

Sharing

General

Target

2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c
Size

288KB
Sample

231007-z4x1wahg83
MD5

870454d6dc60474e5c98db3a6551aa52
SHA1

5f4cab81e841059908b4a252740dbfec429f1d8c
SHA256

2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c
SHA512

e3a6397090b3bb82de407b1b43d21c47161097bf4deee407e862f7baf65b319db83aabd5a92be12ffff373d907966f060b5ad2aad5a6c6d2b967e7fef23d0c83
SSDEEP

3072:3aqUIlWrtEgY1HVxRwDRwXalOJTpr7f2rz7mImr4Z:Kq5W2l1HVxRwDqKI4/Bmr

Score

10^/10

smokeloader 0024 backdoor collection evasion trojan

Malware Config

Extracted

Family

smokeloader

Botnet

0024

Extracted

Family

smokeloader

Version

2022

C2

https://utah-saints.com/search.php

https://atlanta-newspaper.com/search.php

rc4.i32

rc4.i32

Targets

- Target
  
  2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c
- Size
  
  288KB
- MD5
  
  870454d6dc60474e5c98db3a6551aa52
- SHA1
  
  5f4cab81e841059908b4a252740dbfec429f1d8c
- SHA256
  
  2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c
- SHA512
  
  e3a6397090b3bb82de407b1b43d21c47161097bf4deee407e862f7baf65b319db83aabd5a92be12ffff373d907966f060b5ad2aad5a6c6d2b967e7fef23d0c83
- SSDEEP
  
  3072:3aqUIlWrtEgY1HVxRwDRwXalOJTpr7f2rz7mImr4Z:Kq5W2l1HVxRwDqKI4/Bmr
Score

10^/10

smokeloader 0024 backdoor collection evasion trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Modifies Windows Firewall
  evasion
- Accesses Microsoft Outlook profiles
  collection
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloader0024backdoorcollectionevasiontrojan