smokeloader

General

Target

SecuriteInfo.com.Win32.PWSX-gen.32353.16014.exe
Size

301KB
Sample

231014-ejch8ahc36
MD5

92655ee9fd597b85b09a085a2c21fbe1
SHA1

f60f980e9a5c315722b3953638f9f5da85ed4a7e
SHA256

fefa50ffd7c9e19b4c4d84e664b894c6377196942024b71ee371c466d194ee9c
SHA512

b01ccaf9c11c7ed1d3e2765c2f5590e53ba3ddac41a651298bf92028dccc0120431b91fc430b1cb587b3014f17e386605eba27559aa425e6f8beb7da23dc165c
SSDEEP

3072:WGFC2nPsomShMORKs+l5DRWcOQCFOTcCshoPvsAN5N0NUO8J:jF0omShrRTcDRBOLOTcA/Ub

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Targets

- Target
  
  SecuriteInfo.com.Win32.PWSX-gen.32353.16014.exe
- Size
  
  301KB
- MD5
  
  92655ee9fd597b85b09a085a2c21fbe1
- SHA1
  
  f60f980e9a5c315722b3953638f9f5da85ed4a7e
- SHA256
  
  fefa50ffd7c9e19b4c4d84e664b894c6377196942024b71ee371c466d194ee9c
- SHA512
  
  b01ccaf9c11c7ed1d3e2765c2f5590e53ba3ddac41a651298bf92028dccc0120431b91fc430b1cb587b3014f17e386605eba27559aa425e6f8beb7da23dc165c
- SSDEEP
  
  3072:WGFC2nPsomShMORKs+l5DRWcOQCFOTcCshoPvsAN5N0NUO8J:jF0omShrRTcDRBOLOTcA/Ub
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2