smokeloader

General

Target

6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705
Size

237KB
Sample

240417-jd367sae4x
MD5

e308b7fa2baf837eecf395b769548ae7
SHA1

2a9c7cbeafa17e1a94e61b71589ac89d5e78f89d
SHA256

6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705
SHA512

c417e014563048c43f31f6c0d419809972a7ebd33c647d90132ed778b8472ca8c9f983e2f9b0d1aeeccca27e34ec939f8208b4a8d40720d914307ddb2e1b4f8e
SSDEEP

3072:FIVndLEHQtlmk5fIBWk/9eJ1il+3k6OPmUT55nlIeONDZuUt5cUQ:FadLEHQH9KVleDilwk6OPPdON1

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705
- Size
  
  237KB
- MD5
  
  e308b7fa2baf837eecf395b769548ae7
- SHA1
  
  2a9c7cbeafa17e1a94e61b71589ac89d5e78f89d
- SHA256
  
  6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705
- SHA512
  
  c417e014563048c43f31f6c0d419809972a7ebd33c647d90132ed778b8472ca8c9f983e2f9b0d1aeeccca27e34ec939f8208b4a8d40720d914307ddb2e1b4f8e
- SSDEEP
  
  3072:FIVndLEHQtlmk5fIBWk/9eJ1il+3k6OPmUT55nlIeONDZuUt5cUQ:FadLEHQH9KVleDilwk6OPPdON1
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2