smokeloader

General

Target

bcdfff17f59ec08ae2e0d1c420a36441
Size

176KB
Sample

240309-1j6b7abd43
MD5

bcdfff17f59ec08ae2e0d1c420a36441
SHA1

bc8e5c179ee65cdc43e7d6465ba148f264cef98c
SHA256

ec5d0c18661d4915a4e24d844eb5c53e560640e348e96f7edb39fb165660a9bb
SHA512

c064980467ecb4f7a5c90bae981796ebec073f28a14669f2d3f7b87218d94dafcb2f6cf7a5266180e0e4dcc85edfca93b15402a25d3bea6f2ba68bfe01baaf4c
SSDEEP

3072:WUR8oLwlyMMa4NfBw3ZQ0z0KV5gXtjSwrv9ENPGiR6KJIX:nRrLwlp4ZBw3iBtVvMGikK

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Targets

- Target
  
  bcdfff17f59ec08ae2e0d1c420a36441
- Size
  
  176KB
- MD5
  
  bcdfff17f59ec08ae2e0d1c420a36441
- SHA1
  
  bc8e5c179ee65cdc43e7d6465ba148f264cef98c
- SHA256
  
  ec5d0c18661d4915a4e24d844eb5c53e560640e348e96f7edb39fb165660a9bb
- SHA512
  
  c064980467ecb4f7a5c90bae981796ebec073f28a14669f2d3f7b87218d94dafcb2f6cf7a5266180e0e4dcc85edfca93b15402a25d3bea6f2ba68bfe01baaf4c
- SSDEEP
  
  3072:WUR8oLwlyMMa4NfBw3ZQ0z0KV5gXtjSwrv9ENPGiR6KJIX:nRrLwlp4ZBw3iBtVvMGikK
Score

10^/10

smokeloader backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2