smokeloader

General

Target

dd5e21a253fc73601aace400d17685af.bin
Size

134KB
Sample

231211-dw17nsbfgl
MD5

1bd6bda5260214ce4ec013b4da29076d
SHA1

bef1b97e63f5118dac81e9fd8f7eccfcd27b30ad
SHA256

d579f137f304e58a97437c3892e8046a932f8328731a5be8d1dbed8115bbdf29
SHA512

ec1615b364238358ea197760e761ad76408089c4bbf6d9448a8032bd0ed68558c6791058f5fd6dba4637a7dac38c07187c9e9aa3c05b5fada9cdb9104289b7aa
SSDEEP

3072:bCMu4hO7goI6krumo/vxOq3TTLh31fc3eENgEOLwEG1956bUjr:GXUumKxOwDwGzu3r

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://humydrole.com/tmp/index.php

http://trunk-co.ru/tmp/index.php

http://weareelight.com/tmp/index.php

http://pirateking.online/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Targets

- Target
  
  9eddeebc0caaaf59847d80064d1fe276dabd87306e3ad0e768c69c4d5b0ead9d.exe
- Size
  
  211KB
- MD5
  
  dd5e21a253fc73601aace400d17685af
- SHA1
  
  e2366de497c966316e51c6c249b401c24bc09eee
- SHA256
  
  9eddeebc0caaaf59847d80064d1fe276dabd87306e3ad0e768c69c4d5b0ead9d
- SHA512
  
  1bd06ea3bbf3a1101718aacd0b9e48b64919a76d5d778b47a364e42aa937b7cb1adb99b805db5cdb737acee5af72b486d40f38d9a41eaa807881f02cc64159c6
- SSDEEP
  
  3072:BqGLRIhlEkMMD4qxPxxk+imo0zgF7LbWFzR+Ax:EGLRGyRidPxxksoiglLE
Score

10^/10

smokeloader pub4 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2