smokeloader

General

Target

f89ca16569af9a2a3e03f825ad6eef16d4d32fc7e5cfc30c9cd30072f54b0e3b
Size

233KB
Sample

240219-t3w5asgg79
MD5

212227578c45b01ea60be9625108a2b8
SHA1

4a126a237fea9d5a144655123e17fe40ebce5fc9
SHA256

f89ca16569af9a2a3e03f825ad6eef16d4d32fc7e5cfc30c9cd30072f54b0e3b
SHA512

2de3dcbf84240db00a60f388f6aec394a1a8a0c984a1faf09da9a18a5e7bf2e75fa63a57377a85c7d32b25518e4373ec1352c398fea909fadd0e050ec8baf0a8
SSDEEP

3072:KFBZ9zen3Oc1FJfCv0Y6jHIxnW9PHHX82GEYyEFADOIzJ70x8b+AuXB55Sm48MA:0c+SCv0RHIxnUPHX8gG2DvZ+8uwf

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://sjyey.com/tmp/index.php

http://babonwo.ru/tmp/index.php

http://mth.com.ua/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Targets

- Target
  
  f89ca16569af9a2a3e03f825ad6eef16d4d32fc7e5cfc30c9cd30072f54b0e3b
- Size
  
  233KB
- MD5
  
  212227578c45b01ea60be9625108a2b8
- SHA1
  
  4a126a237fea9d5a144655123e17fe40ebce5fc9
- SHA256
  
  f89ca16569af9a2a3e03f825ad6eef16d4d32fc7e5cfc30c9cd30072f54b0e3b
- SHA512
  
  2de3dcbf84240db00a60f388f6aec394a1a8a0c984a1faf09da9a18a5e7bf2e75fa63a57377a85c7d32b25518e4373ec1352c398fea909fadd0e050ec8baf0a8
- SSDEEP
  
  3072:KFBZ9zen3Oc1FJfCv0Y6jHIxnW9PHHX82GEYyEFADOIzJ70x8b+AuXB55Sm48MA:0c+SCv0RHIxnUPHX8gG2DvZ+8uwf
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2