smokeloader

General

Target

8bccbbaf0dd17770aabe39e2d43b2748
Size

270KB
Sample

240203-jrf9laehbk
MD5

8bccbbaf0dd17770aabe39e2d43b2748
SHA1

948ada87276d9284a787b19ee9259f026677e726
SHA256

6913c25f5eff616fd043909d0a96175b498d9a1dd74a1743d6a3296a175c902f
SHA512

b1703e56edaeb5abcb856ffbc593e6a6ea134b24bba0bbb2451125c03d069039a5af478671fbbef7a43a233906fb9f06873db8e9bf93858162953dc296829339
SSDEEP

6144:8pRzJKZnDh8oakpAyLMSAsO5Fhq3ismJpm5Jz:OzkZnDh8zkDLtAZ/wSxLm59

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Targets

- Target
  
  8bccbbaf0dd17770aabe39e2d43b2748
- Size
  
  270KB
- MD5
  
  8bccbbaf0dd17770aabe39e2d43b2748
- SHA1
  
  948ada87276d9284a787b19ee9259f026677e726
- SHA256
  
  6913c25f5eff616fd043909d0a96175b498d9a1dd74a1743d6a3296a175c902f
- SHA512
  
  b1703e56edaeb5abcb856ffbc593e6a6ea134b24bba0bbb2451125c03d069039a5af478671fbbef7a43a233906fb9f06873db8e9bf93858162953dc296829339
- SSDEEP
  
  6144:8pRzJKZnDh8oakpAyLMSAsO5Fhq3ismJpm5Jz:OzkZnDh8zkDLtAZ/wSxLm59
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2