smokeloader

General

Target

f6f190754da61d3e66289bb96ca517d40a6f9cf038000eac953ba1723e0165a6
Size

307KB
Sample

240321-2vc1fscf32
MD5

202e55f294d0b5b5963d5230342f675d
SHA1

e98bc53163c61fce97ac32fe89c8a4d59d2d3840
SHA256

f6f190754da61d3e66289bb96ca517d40a6f9cf038000eac953ba1723e0165a6
SHA512

e03a3643a96442671557bafa6b1fe8df7a4eb3a1ef75af493c8dd54d5763b62ed4a533e55b0bd2a90fdc2988d5ffc03cbec7da7fd452523d77a31dd195992922
SSDEEP

3072:gdTYAg9rIkn8kI6B+BcKEEXaSqWhtC+c+KA5V15uY0/uMxFlL8M4yywIBRw200BG:gXeDOSCsWhtCqKAj73Mz58MWZBRwXN

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  f6f190754da61d3e66289bb96ca517d40a6f9cf038000eac953ba1723e0165a6
- Size
  
  307KB
- MD5
  
  202e55f294d0b5b5963d5230342f675d
- SHA1
  
  e98bc53163c61fce97ac32fe89c8a4d59d2d3840
- SHA256
  
  f6f190754da61d3e66289bb96ca517d40a6f9cf038000eac953ba1723e0165a6
- SHA512
  
  e03a3643a96442671557bafa6b1fe8df7a4eb3a1ef75af493c8dd54d5763b62ed4a533e55b0bd2a90fdc2988d5ffc03cbec7da7fd452523d77a31dd195992922
- SSDEEP
  
  3072:gdTYAg9rIkn8kI6B+BcKEEXaSqWhtC+c+KA5V15uY0/uMxFlL8M4yywIBRw200BG:gXeDOSCsWhtCqKAj73Mz58MWZBRwXN
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2