smokeloader

General

Target

09eb9ca998f6905f205a88429dba2e80_JaffaCakes118
Size

233KB
Sample

240328-tha2bsac6t
MD5

09eb9ca998f6905f205a88429dba2e80
SHA1

23c62b405621e180a9e50b7b25057ff4b5a4b239
SHA256

01f6cb222552c7de5a822017d9979103aea06847d186234c8aa4e085fcc16d48
SHA512

2c3a6119adabab897d779f5fafaf0264910c557ece98af49cad8006998b4dd61e013700b94ec3b93ae8e3a97f03623aae152bab0511f3aefd626e3baac11da8e
SSDEEP

3072:DGxKfv13piO9tzL797sgIqz6iHzraaPe+CNf4/AWaSkSJu98vd:lv13piOfLtsw6iHzrFUIADG8el

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Targets

- Target
  
  09eb9ca998f6905f205a88429dba2e80_JaffaCakes118
- Size
  
  233KB
- MD5
  
  09eb9ca998f6905f205a88429dba2e80
- SHA1
  
  23c62b405621e180a9e50b7b25057ff4b5a4b239
- SHA256
  
  01f6cb222552c7de5a822017d9979103aea06847d186234c8aa4e085fcc16d48
- SHA512
  
  2c3a6119adabab897d779f5fafaf0264910c557ece98af49cad8006998b4dd61e013700b94ec3b93ae8e3a97f03623aae152bab0511f3aefd626e3baac11da8e
- SSDEEP
  
  3072:DGxKfv13piO9tzL797sgIqz6iHzraaPe+CNf4/AWaSkSJu98vd:lv13piOfLtsw6iHzrFUIADG8el
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2