smokeloader

General

Target

17779ddb4bc3962bda0b0461ddf3eaf665c54364b3abe98d209b6f40781a1ab9
Size

301KB
Sample

231014-dxsa6afe48
MD5

f5e6eae839c0b6c9d7f1c6141c01cc74
SHA1

8845fb5cc5d173f768555f69d8fa97eae0b9dc38
SHA256

17779ddb4bc3962bda0b0461ddf3eaf665c54364b3abe98d209b6f40781a1ab9
SHA512

28b797f3224540473e868f869129dffe8470eb57706a707df861091730fb849c0039223531ff4c975a94534b895c2bbe91621d726b73884c8a508412c1198e48
SSDEEP

6144:SG6/2ie+G2auN4yyYd5Gypbn2UHFV+FKj:StG+tae4JYd5hnn

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Targets

- Target
  
  17779ddb4bc3962bda0b0461ddf3eaf665c54364b3abe98d209b6f40781a1ab9
- Size
  
  301KB
- MD5
  
  f5e6eae839c0b6c9d7f1c6141c01cc74
- SHA1
  
  8845fb5cc5d173f768555f69d8fa97eae0b9dc38
- SHA256
  
  17779ddb4bc3962bda0b0461ddf3eaf665c54364b3abe98d209b6f40781a1ab9
- SHA512
  
  28b797f3224540473e868f869129dffe8470eb57706a707df861091730fb849c0039223531ff4c975a94534b895c2bbe91621d726b73884c8a508412c1198e48
- SSDEEP
  
  6144:SG6/2ie+G2auN4yyYd5Gypbn2UHFV+FKj:StG+tae4JYd5hnn
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2