smokeloader

General

Target

file
Size

266KB
Sample

231012-nf2tdafd4x
MD5

be527f26f13962e89509dd096166f55e
SHA1

fc229d2242785afe7b5493dd13a86ea1ada1d7b9
SHA256

ff5794af33667de77d1b287bb096b8153b1c7d096ec1d940de3bb9692c95251c
SHA512

734ae624f5780f6b661e1688340027c2d87939d0181b8ce612c6e90e2ada597d32742662888cf3a136ef44976a01189874304a095b52be5bfa2472bf0a759501
SSDEEP

3072:rBXiXrLPgrVGtJtNHj9/c4i8oCMhvKkuFyWvnbKn:xAr0rEtJ3DU8oBqyWvnb

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Targets

- Target
  
  file
- Size
  
  266KB
- MD5
  
  be527f26f13962e89509dd096166f55e
- SHA1
  
  fc229d2242785afe7b5493dd13a86ea1ada1d7b9
- SHA256
  
  ff5794af33667de77d1b287bb096b8153b1c7d096ec1d940de3bb9692c95251c
- SHA512
  
  734ae624f5780f6b661e1688340027c2d87939d0181b8ce612c6e90e2ada597d32742662888cf3a136ef44976a01189874304a095b52be5bfa2472bf0a759501
- SSDEEP
  
  3072:rBXiXrLPgrVGtJtNHj9/c4i8oCMhvKkuFyWvnbKn:xAr0rEtJ3DU8oBqyWvnb
Score

10^/10

smokeloader pub4 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2