smokeloader

General

Target

file
Size

268KB
Sample

231013-1e2s7sbf2s
MD5

cd081022c318928de99d1f414a485a15
SHA1

8ebd20c0d5cbfae31ffaf846020309910a3cdd7f
SHA256

b1c8edb8926c2287a9f7d2432225566ec6dfbb2e0a1db7e95b55db7f6cf19820
SHA512

5f9eefcf1badea679c8027b6cf92ec09dc1a7476bfad8f7f6f974cc86567124416eac21a8acbcd037fad9405ec174165170993ecefa8e5ff7b6e139368875d72
SSDEEP

3072:VnEHOxB2mXQ+YJq4cLZaGnohV6q+WEprvwjmcakX6OOD6RV/18i2NrB:WHOxVXQ+Yo4gZqV6qMxwSg1VMB

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Targets

- Target
  
  file
- Size
  
  268KB
- MD5
  
  cd081022c318928de99d1f414a485a15
- SHA1
  
  8ebd20c0d5cbfae31ffaf846020309910a3cdd7f
- SHA256
  
  b1c8edb8926c2287a9f7d2432225566ec6dfbb2e0a1db7e95b55db7f6cf19820
- SHA512
  
  5f9eefcf1badea679c8027b6cf92ec09dc1a7476bfad8f7f6f974cc86567124416eac21a8acbcd037fad9405ec174165170993ecefa8e5ff7b6e139368875d72
- SSDEEP
  
  3072:VnEHOxB2mXQ+YJq4cLZaGnohV6q+WEprvwjmcakX6OOD6RV/18i2NrB:WHOxVXQ+Yo4gZqV6qMxwSg1VMB
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2