smokeloader

General

Target

file
Size

245KB
Sample

231117-hya6gsgb63
MD5

fa37dc7a99eb2e6f94c5b84d9db371f9
SHA1

21e66948cae5256a4dd1e6bb9d2394b429e62510
SHA256

6bdfb620003859b5a5318fda333a8950d7d0edf266f297b8e3ae62b6018a07d5
SHA512

de45a2835615265d5978d3a9d93a8ecc4c55a15f66d0727b3465a75d089f90f094c34d39fd4b50631534b90edcc35b74e614737822e6c628fb7d298f8e33d62c
SSDEEP

3072:sqIjfLDcadk0Vrzcd2k5O81JEX1N5imWcB1GaXRtRcfG7eJ21ls/zvl:kjfLQvMIkk0SOXX5fWcvG+RUG4

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://dpav.cc/tmp/

http://lrproduct.ru/tmp/

http://kggcp.com/tmp/

http://talesofpirates.net/tmp/

http://pirateking.online/tmp/

http://piratia.pw/tmp/

http://go-piratia.ru/tmp/

rc4.i32

Targets

- Target
  
  file
- Size
  
  245KB
- MD5
  
  fa37dc7a99eb2e6f94c5b84d9db371f9
- SHA1
  
  21e66948cae5256a4dd1e6bb9d2394b429e62510
- SHA256
  
  6bdfb620003859b5a5318fda333a8950d7d0edf266f297b8e3ae62b6018a07d5
- SHA512
  
  de45a2835615265d5978d3a9d93a8ecc4c55a15f66d0727b3465a75d089f90f094c34d39fd4b50631534b90edcc35b74e614737822e6c628fb7d298f8e33d62c
- SSDEEP
  
  3072:sqIjfLDcadk0Vrzcd2k5O81JEX1N5imWcB1GaXRtRcfG7eJ21ls/zvl:kjfLQvMIkk0SOXX5fWcvG+RUG4
Score

10^/10

smokeloader pub4 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2