smokeloader

General

Target

31f26167853ae96bcb9a74cfbf5458d5e0ee8d2ff6fb245295ff2d71cc0cb30b
Size

191KB
Sample

240403-bn1j3abe3y
MD5

ced33bff8b607ed0d84d34ca8b52bb84
SHA1

82a9b5c1d83706e9b55b942bfba4c15847166d1d
SHA256

31f26167853ae96bcb9a74cfbf5458d5e0ee8d2ff6fb245295ff2d71cc0cb30b
SHA512

0f9545466f281108bb24827d88898daa6cd78bdf95625c1f652428af013106dfb9377934cf6c4008a911d441da25c153ec1fe432c5b0bf0de20d845e638001fe
SSDEEP

3072:rQ0awDqTd/IrZTilB2XsPDu4qi0vIvNDzek3Oe5mgyot46a:r8QqTd/IrZoSs7ufbEN/ekt1L

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  31f26167853ae96bcb9a74cfbf5458d5e0ee8d2ff6fb245295ff2d71cc0cb30b
- Size
  
  191KB
- MD5
  
  ced33bff8b607ed0d84d34ca8b52bb84
- SHA1
  
  82a9b5c1d83706e9b55b942bfba4c15847166d1d
- SHA256
  
  31f26167853ae96bcb9a74cfbf5458d5e0ee8d2ff6fb245295ff2d71cc0cb30b
- SHA512
  
  0f9545466f281108bb24827d88898daa6cd78bdf95625c1f652428af013106dfb9377934cf6c4008a911d441da25c153ec1fe432c5b0bf0de20d845e638001fe
- SSDEEP
  
  3072:rQ0awDqTd/IrZTilB2XsPDu4qi0vIvNDzek3Oe5mgyot46a:r8QqTd/IrZoSs7ufbEN/ekt1L
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2