smokeloader

General

Target
6e8775e8089cba93802f59d506afa09a.exe
Size 207KB
Sample240112-mxtnnafcc4
SHA256 14bf7a5b4420073171f0cb75ee7f7bbab035ec7a0695ff0f1493c1a648f29a5b
MD5 6e8775e8089cba93802f59d506afa09a
SHA1 2ab1e3ab1fd32770c5825a589bb7f849af31ba73
SHA512 d897a23bd9425b91cbb0bddc809c13dfd5947a8622e5808c950457abe28129904f5160e029981dd3542d81205393c8816783903122b090bb78789903cd06f498
SSDEEP 3072:TI/htLJYeiJiiK8XBk//pIp7b2YBdmDkAw6xRJvBL2A:0TLJYeuByahb2Yy2B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php

rc4.i32

Targets

- Target
  6e8775e8089cba93802f59d506afa09a.exe
- Size 207KB
- SHA256 14bf7a5b4420073171f0cb75ee7f7bbab035ec7a0695ff0f1493c1a648f29a5b
- MD5 6e8775e8089cba93802f59d506afa09a
- SHA1 2ab1e3ab1fd32770c5825a589bb7f849af31ba73
- SHA512 d897a23bd9425b91cbb0bddc809c13dfd5947a8622e5808c950457abe28129904f5160e029981dd3542d81205393c8816783903122b090bb78789903cd06f498
- SSDEEP 3072:TI/htLJYeiJiiK8XBk//pIp7b2YBdmDkAw6xRJvBL2A:0TLJYeuByahb2Yy2B
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan upx vidar zgrat rat stealer
- Detect Vidar Stealer
  stealer
- Detect ZGRat V1
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Vidar Stealer

Detect ZGRat V1

Vidar

ZGRat

Downloads MZ/PE file

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2