smokeloader

Target

79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.zip
Size

188KB
Sample

240221-xanh8sdd21
MD5

9589d70973b25b23ef6463febfa1d232
SHA1

3e59cb26229c9668141d591b7ef6ddad51da1bc3
SHA256

2fa5adb1940605fdf9a3b39af904fe7cc2dba8d70039e1f96829a510242d71e2
SHA512

a0c5a01ed41d5c59014d4e9df9c92bd8c7aed42305508afba6e696f17b7ef085146dd321075fadf61aaf2af8b03d760011aa4d2c5f2b9f9e96c2993c245b7ba0
SSDEEP

3072:4st/N3hi2aPG8896EbLXjClJzpYlyCV3p9vdYiL/gxqq3pJ/YNlK:4ilxVaPG88kEbDjIVYH36CIxqqbArK

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Targets

- Target
  
  79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
- Size
  
  298KB
- MD5
  
  11511ba5fd4de1fc5051d0bcefb388ae
- SHA1
  
  5e9476f39df92e01d0952e703869e71f85d470cd
- SHA256
  
  79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a
- SHA512
  
  904f0e3a252cd0ef8108492de955ac520008b10b66da736cc4bbdc6a8c3736440a9a11edb73707ba415d7f3f4c2c590dfa983aca01864b9d66a6c3559ed744e9
- SSDEEP
  
  3072:0pb2LIT54Ga9Qzgp4gaCJrSjgBoMZmYKxQCBnIyCSyxzID1C7hZW0KIsiuNZ:xLIKGa96dfkBoMsDlqSwzIDM/KPP
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2