smokeloader

General

Target

05600ece85456b52829907cbcb96a804ad81c8e7c0bd614ba358faac26f33b9d
Size

218KB
Sample

231113-fekvgahh72
MD5

f5771ca602ae85f979c27de42840e120
SHA1

2cdaf4a6f85acae850ce59685c80fbca785d262a
SHA256

05600ece85456b52829907cbcb96a804ad81c8e7c0bd614ba358faac26f33b9d
SHA512

913d4407c7244e3a31e317d63e58ed31863339373afd9a3c28d9370cbf81e237eba63a172446b9635d72fbf823183545b265395efab044a5d6260a34e7676d06
SSDEEP

3072:DWwQzojKKKei1Sk7SSyRHa71a+BaJbeJ4dnb4hYZSZ:vjKJ1fg1Qa+8974a

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://dpav.cc/tmp/

http://lrproduct.ru/tmp/

http://kggcp.com/tmp/

http://talesofpirates.net/tmp/

http://pirateking.online/tmp/

http://piratia.pw/tmp/

http://go-piratia.ru/tmp/

rc4.i32

Targets

- Target
  
  05600ece85456b52829907cbcb96a804ad81c8e7c0bd614ba358faac26f33b9d
- Size
  
  218KB
- MD5
  
  f5771ca602ae85f979c27de42840e120
- SHA1
  
  2cdaf4a6f85acae850ce59685c80fbca785d262a
- SHA256
  
  05600ece85456b52829907cbcb96a804ad81c8e7c0bd614ba358faac26f33b9d
- SHA512
  
  913d4407c7244e3a31e317d63e58ed31863339373afd9a3c28d9370cbf81e237eba63a172446b9635d72fbf823183545b265395efab044a5d6260a34e7676d06
- SSDEEP
  
  3072:DWwQzojKKKei1Sk7SSyRHa71a+BaJbeJ4dnb4hYZSZ:vjKJ1fg1Qa+8974a
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2