smokeloader

General

Target

2adf4581364c32549d7b32826b88d7b7408214e91deee492ef3bdd846a42f526.exe
Size

311KB
Sample

240111-yvmm4sfcep
MD5

5fb837c05b92590f5e23e89eff60d6a1
SHA1

93595e218d3664d92055d60ef1753141e4fd053d
SHA256

2adf4581364c32549d7b32826b88d7b7408214e91deee492ef3bdd846a42f526
SHA512

2813c7643d984f3479bc83ebe04d92dcf285640e26e9cc60a9d742a193af4651bdfa43f595fdaee7f91c2b6c15147aec04eda876edf6cf3325fa52addf316346
SSDEEP

3072:U8EGKLRYmuaZn29+DCxz+JwMom5WG5sKI36Fwj0:UljLRXuaZnIVMr6737

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32

Targets

- Target
  
  2adf4581364c32549d7b32826b88d7b7408214e91deee492ef3bdd846a42f526.exe
- Size
  
  311KB
- MD5
  
  5fb837c05b92590f5e23e89eff60d6a1
- SHA1
  
  93595e218d3664d92055d60ef1753141e4fd053d
- SHA256
  
  2adf4581364c32549d7b32826b88d7b7408214e91deee492ef3bdd846a42f526
- SHA512
  
  2813c7643d984f3479bc83ebe04d92dcf285640e26e9cc60a9d742a193af4651bdfa43f595fdaee7f91c2b6c15147aec04eda876edf6cf3325fa52addf316346
- SSDEEP
  
  3072:U8EGKLRYmuaZn29+DCxz+JwMom5WG5sKI36Fwj0:UljLRXuaZnIVMr6737
Score

10^/10

smokeloader backdoor trojan vidar zgrat rat stealer
- Detect Vidar Stealer
  stealer
- Detect ZGRat V1
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Vidar Stealer

Detect ZGRat V1

Vidar

ZGRat

Downloads MZ/PE file

Deletes itself

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2