smokeloader

General

Target

file
Size

763KB
Sample

240406-njq62shg83
MD5

65180cf1054b95d9171772202b4b520a
SHA1

d5a0a4b342cd785d5e01546fadd26834cd8b9168
SHA256

bb5a089a3b7524293144b6d235babdc8af566cc6d54217b88130566c8e647e4e
SHA512

df9deca3a89f1dbde1cb952ebc4834a3123efc09f59ccdfc1a72115f03c5fde24de83f69adab71b0b5064c43b27d6f9f53076f14d83f56f249779e28b9cda5ed
SSDEEP

12288:Ngv/glM5bRppJ52h22uc1IwQQewLpHOkAMRF5UotqJsp8tHEUK6Lh77uSmM0hPL:qnKKRppJ52h2Tc1IwQQewluq3qw8tsay

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://sunvi.org/tmp/index.php

http://zarya-amura.ru/tmp/index.php

http://akros.in.net/tmp/index.php

rc4.i32

Targets

- Target
  
  file
- Size
  
  763KB
- MD5
  
  65180cf1054b95d9171772202b4b520a
- SHA1
  
  d5a0a4b342cd785d5e01546fadd26834cd8b9168
- SHA256
  
  bb5a089a3b7524293144b6d235babdc8af566cc6d54217b88130566c8e647e4e
- SHA512
  
  df9deca3a89f1dbde1cb952ebc4834a3123efc09f59ccdfc1a72115f03c5fde24de83f69adab71b0b5064c43b27d6f9f53076f14d83f56f249779e28b9cda5ed
- SSDEEP
  
  12288:Ngv/glM5bRppJ52h22uc1IwQQewLpHOkAMRF5UotqJsp8tHEUK6Lh77uSmM0hPL:qnKKRppJ52h2Tc1IwQQewluq3qw8tsay
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2