smokeloader

General

Target

ed0f0a8f76dc993475ef31ba3b2e755f_JaffaCakes118
Size

145KB
Sample

240411-k2ap8sgc66
MD5

ed0f0a8f76dc993475ef31ba3b2e755f
SHA1

209a973b09e1eeb28f4b7d5b157d1bf379609ace
SHA256

00169bddf9e9803502d64a34a1344407e8cda4a9933834452fea7522a213763b
SHA512

de67d962927055e10d3322163880f06ed3bcf3b91478e95be3fbf2a4616305d85bcb639ab7772ac72ea1e926b2edd731f217f6949f17b400effd9e75843d4267
SSDEEP

3072:pFgmEStDDsdDk/FqkfK8Q1ehasjjsk5UCzrS9H6l:p6mESFDlFNn3Ea

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

C2

http://govsurplusstore.com/upload/

http://best-forsale.com/upload/

http://chmxnautoparts.com/upload/

http://kwazone.com/upload/

rc4.i32

Targets

- Target
  
  ed0f0a8f76dc993475ef31ba3b2e755f_JaffaCakes118
- Size
  
  145KB
- MD5
  
  ed0f0a8f76dc993475ef31ba3b2e755f
- SHA1
  
  209a973b09e1eeb28f4b7d5b157d1bf379609ace
- SHA256
  
  00169bddf9e9803502d64a34a1344407e8cda4a9933834452fea7522a213763b
- SHA512
  
  de67d962927055e10d3322163880f06ed3bcf3b91478e95be3fbf2a4616305d85bcb639ab7772ac72ea1e926b2edd731f217f6949f17b400effd9e75843d4267
- SSDEEP
  
  3072:pFgmEStDDsdDk/FqkfK8Q1ehasjjsk5UCzrS9H6l:p6mESFDlFNn3Ea
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2