smokeloader

General

Target

a18b856289855086c6208db3507c3351_JaffaCakes118
Size

316KB
Sample

240403-gb251shh22
MD5

a18b856289855086c6208db3507c3351
SHA1

44f46bd5f2507d2c62f66b72f8e224d37ecf7b18
SHA256

c343d983164eed9615694c3cca990acd7c82c908f04b61005eaeffc0080bf11a
SHA512

877c6f4506653cc471a2e7af4245f81367ea7e4b99106ced3daa3817d982039d5d1387bad9990933ae41e292aec15a988b4183e82cdc66ce96d83a502ee80f1f
SSDEEP

6144:jEzOzivF/3w2M0GqCA0y5481BsmqlM1kKd:Q7ZoJA0y54wsmql+

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Targets

- Target
  
  a18b856289855086c6208db3507c3351_JaffaCakes118
- Size
  
  316KB
- MD5
  
  a18b856289855086c6208db3507c3351
- SHA1
  
  44f46bd5f2507d2c62f66b72f8e224d37ecf7b18
- SHA256
  
  c343d983164eed9615694c3cca990acd7c82c908f04b61005eaeffc0080bf11a
- SHA512
  
  877c6f4506653cc471a2e7af4245f81367ea7e4b99106ced3daa3817d982039d5d1387bad9990933ae41e292aec15a988b4183e82cdc66ce96d83a502ee80f1f
- SSDEEP
  
  6144:jEzOzivF/3w2M0GqCA0y5481BsmqlM1kKd:Q7ZoJA0y54wsmql+
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2