smokeloader | 4499c71fa8d1fa138f09865eec896f98161b3118e86368b2ebf1a125b9d3ed37 | Triage

Sharing

General

Target

4499c71fa8d1fa138f09865eec896f98161b3118e86368b2ebf1a125b9d3ed37
Size

254KB
Sample

231022-n5185shh73
MD5

8499cb486e36f85d512c7da5016662e9
SHA1

66114039b2a1f93c8a2dfa30ba8cb724873ba16a
SHA256

4499c71fa8d1fa138f09865eec896f98161b3118e86368b2ebf1a125b9d3ed37
SHA512

d247b2b325d2a47f766818dee7979316d1dbe81e8738ff948b1941d51a93871b09a3b65143e15318cf7b97a92de42858f900864e51b853b50726378e1ac2da4c
SSDEEP

3072:VyBN7HcxAHG6NM3vkEJb2s4ADxcHl+loYvHx/2mQOTGZxsmSWWb:QdH6AH9NMfkXt+S2X4mQoGnFS

Score

10^/10

smokeloader 0024 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

0024

Extracted

Family

smokeloader

Version

2022

C2

https://utah-saints.com/search.php

https://atlanta-newspaper.com/search.php

rc4.i32

rc4.i32

Targets

- Target
  
  4499c71fa8d1fa138f09865eec896f98161b3118e86368b2ebf1a125b9d3ed37
- Size
  
  254KB
- MD5
  
  8499cb486e36f85d512c7da5016662e9
- SHA1
  
  66114039b2a1f93c8a2dfa30ba8cb724873ba16a
- SHA256
  
  4499c71fa8d1fa138f09865eec896f98161b3118e86368b2ebf1a125b9d3ed37
- SHA512
  
  d247b2b325d2a47f766818dee7979316d1dbe81e8738ff948b1941d51a93871b09a3b65143e15318cf7b97a92de42858f900864e51b853b50726378e1ac2da4c
- SSDEEP
  
  3072:VyBN7HcxAHG6NM3vkEJb2s4ADxcHl+loYvHx/2mQOTGZxsmSWWb:QdH6AH9NMfkXt+S2X4mQoGnFS
Score

10^/10

smokeloader 0024 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloader0024backdoortrojan