smokeloader

General

Target

8a5470dacffd827540a8eed664f5d981ad7293bf7e7678a1888dad722bd30a68
Size

163KB
Sample

240417-q1jveaab38
MD5

56cc53a846fd7b76138ae9c7bff999c4
SHA1

099383ef904a90fcfe36abed3470ccc20f8cc33e
SHA256

8a5470dacffd827540a8eed664f5d981ad7293bf7e7678a1888dad722bd30a68
SHA512

b9c870551045c9ecb6a3ea03e5b3848fcecef81d5f3481c75175a97c3a2618c7df70e0cca14d64cbb83ab8d216cf59d628d2e1218f50d812d1152ee4296f29f7
SSDEEP

3072:DyGfL99+M9wAB9da4N4Zk6G7uYQejPDQ/gTUBRF4NklnYEpIDv2fYmp5+U:P5P9o+ruKzV8Iklrov2fYTU

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://sjyey.com/tmp/index.php

http://babonwo.ru/tmp/index.php

http://mth.com.ua/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Targets

- Target
  
  4ba5c87a94c9929e51c3c8c09b45d8a70fda5e1518691c979b770d64bec3cf4d.exe
- Size
  
  269KB
- MD5
  
  9f034c7e35bd5ac25923a93605d516cf
- SHA1
  
  57f6639214c0585ac2ca94c1fe4ec9dd7c42267d
- SHA256
  
  4ba5c87a94c9929e51c3c8c09b45d8a70fda5e1518691c979b770d64bec3cf4d
- SHA512
  
  523c066a61ae37452d25a59728938ec360b1d49962b4c26f319c8f8afbcad1c8412c973ca48cf25679de3a6844f2854d683512697117e4f25bda954f117ea107
- SSDEEP
  
  3072:LKKN3V681HJ6hLz1elSSUfaZ99u9wHxa+cty1FFxofkKaqUjlg5bAZ8:W69A5ek847+1Zx4kKy+A
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2