smokeloader

General

Target

b34e897f8dc7b0c149b397f708246d86
Size

327KB
Sample

240304-2vq73sga2v
MD5

b34e897f8dc7b0c149b397f708246d86
SHA1

64fc92be67558663b2ffde9b68ab6f860fa2bda0
SHA256

e34a8036867bb1bd5d9e30d318145b8d1fd98067e41c9f3f6910d283bc54c11c
SHA512

8cddf19e9a86afea95ee663e94084f398a972477513bc08a48697983a01f0c90a7064532f7f3f3202689873011feb09bc955000c0e8383230650c7d4ccab7a49
SSDEEP

6144:iBDu5mAAm9Psusy0lsY2sExiy77sQWsr3oFQLe/rD7skX:I6mAtCusy0usExiwARwpe/P7

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32

Targets

- Target
  
  b34e897f8dc7b0c149b397f708246d86
- Size
  
  327KB
- MD5
  
  b34e897f8dc7b0c149b397f708246d86
- SHA1
  
  64fc92be67558663b2ffde9b68ab6f860fa2bda0
- SHA256
  
  e34a8036867bb1bd5d9e30d318145b8d1fd98067e41c9f3f6910d283bc54c11c
- SHA512
  
  8cddf19e9a86afea95ee663e94084f398a972477513bc08a48697983a01f0c90a7064532f7f3f3202689873011feb09bc955000c0e8383230650c7d4ccab7a49
- SSDEEP
  
  6144:iBDu5mAAm9Psusy0lsY2sExiy77sQWsr3oFQLe/rD7skX:I6mAtCusy0usExiwARwpe/P7
Score

10^/10

smokeloader pub2 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2