smokeloader

General

Target

b9449abe5a4bf6ee410c9a43c9e27ee2f4bcad6956e0b3bd9a71c0191b09fbd4
Size

144KB
Sample

240417-q4m18sbh9s
MD5

96f77cd6dc0455dfae8c12251a7d4ce4
SHA1

9d739aec9f8e93cb9f15c7bf47dca8a581e91a6a
SHA256

b9449abe5a4bf6ee410c9a43c9e27ee2f4bcad6956e0b3bd9a71c0191b09fbd4
SHA512

1575feb36b4222f441f38de101865a2bf71066da31169434899f3f662cc66879142cad0e58045b7ddbc4fe3752bd300fd0618b6b4a9bc614070ef45790c60649
SSDEEP

3072:DRd346NUqiYj6JWBKarD0O4U32beDGqh9eBXqy4:DzxiYj9DGU32cjh9exE

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Targets

- Target
  
  91e8fd048fb5df071ba6e3d7917edcb53122d9cbd9e57dcf4b5e50c72d575c7a.exe
- Size
  
  259KB
- MD5
  
  e5477d6420e21e75a4bb411a3947201a
- SHA1
  
  7120bf0ba0196ecc8cc04dd0c3166185ee3f7892
- SHA256
  
  91e8fd048fb5df071ba6e3d7917edcb53122d9cbd9e57dcf4b5e50c72d575c7a
- SHA512
  
  de56dddda25e1cf9c5835613e38375f463bbcabe858b846077359b704493ef75b14e6187f21f110103bde70cc61efe17e5dac6d229456271b33afa3406c7020d
- SSDEEP
  
  6144:K7vq2CD3/WTO/Ukgn4olUKm4shprkwnf8/9tQ:ERM3/WTO/dgxUWshprDnatQ
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Downloads MZ/PE file

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2