smokeloader

General

Target

947fb340a672bd684a18ab7aeb7fe28cd9f2eee3c0de99c205f3a4a39aad12c0_JC.exe
Size

302KB
Sample

231014-axtbnshg65
MD5

1a8b0853338c0e0eab5d13746038fae9
SHA1

3132faa6943319d0d6a29940698c2fc39fb89062
SHA256

947fb340a672bd684a18ab7aeb7fe28cd9f2eee3c0de99c205f3a4a39aad12c0
SHA512

f2c27edad737d0bc82309bb8fe723fd43fa04a320928ab115fcaba1751a81a6d36ea0ccfd4e5eda6aa520f3afd31047630b6c3eb2387a8d9d4d79ba0c3b99cd4
SSDEEP

3072:OOVBnvCNeLj8S+rLFOhgEl1L1JhrEX7CqluMFkaysVq8fnYO8J:vxoeLj8SKLF0j1LXhQLfoq/7R

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Targets

- Target
  
  947fb340a672bd684a18ab7aeb7fe28cd9f2eee3c0de99c205f3a4a39aad12c0_JC.exe
- Size
  
  302KB
- MD5
  
  1a8b0853338c0e0eab5d13746038fae9
- SHA1
  
  3132faa6943319d0d6a29940698c2fc39fb89062
- SHA256
  
  947fb340a672bd684a18ab7aeb7fe28cd9f2eee3c0de99c205f3a4a39aad12c0
- SHA512
  
  f2c27edad737d0bc82309bb8fe723fd43fa04a320928ab115fcaba1751a81a6d36ea0ccfd4e5eda6aa520f3afd31047630b6c3eb2387a8d9d4d79ba0c3b99cd4
- SSDEEP
  
  3072:OOVBnvCNeLj8S+rLFOhgEl1L1JhrEX7CqluMFkaysVq8fnYO8J:vxoeLj8SKLF0j1LXhQLfoq/7R
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2