smokeloader

General

Target

48e17be851327f252e88be3c083bfc35c7e825fd89b221e4c2246bc4609b9822
Size

276KB
Sample

240404-evgmbaeh35
MD5

2d7fdbb3c2feeb9bc862477b8d95a950
SHA1

28873eefa37d2a70f34721aa886f8a401d1f52bf
SHA256

48e17be851327f252e88be3c083bfc35c7e825fd89b221e4c2246bc4609b9822
SHA512

a38058062735eb90304c143b96b55438b1b471331408afa9d01c3414ec9d3353ef829a0c6c355ee385efcd565122b4d8e7e388b94181625648f6b56e716f70e6
SSDEEP

3072:XeLyveWVkhj6YfBPI0h+RRfiXhf66GE4psLn1Y4WB5m4wo1OQ5wkZKtwx4vmPr+b:X+cDeBhSR6x+w14T7wkZawKBUfITj

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  48e17be851327f252e88be3c083bfc35c7e825fd89b221e4c2246bc4609b9822
- Size
  
  276KB
- MD5
  
  2d7fdbb3c2feeb9bc862477b8d95a950
- SHA1
  
  28873eefa37d2a70f34721aa886f8a401d1f52bf
- SHA256
  
  48e17be851327f252e88be3c083bfc35c7e825fd89b221e4c2246bc4609b9822
- SHA512
  
  a38058062735eb90304c143b96b55438b1b471331408afa9d01c3414ec9d3353ef829a0c6c355ee385efcd565122b4d8e7e388b94181625648f6b56e716f70e6
- SSDEEP
  
  3072:XeLyveWVkhj6YfBPI0h+RRfiXhf66GE4psLn1Y4WB5m4wo1OQ5wkZKtwx4vmPr+b:X+cDeBhSR6x+w14T7wkZawKBUfITj
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2