smokeloader

General

Target

b5db3a7ec06ae9562fadc80af9692bf4012e86ecfe4991687c8b8be083722886
Size

150KB
Sample

240417-q66w5aca9w
MD5

9b49377bd09a440e8201d69114751003
SHA1

a9ea86b5c9789214c215435ec5e4bf5fc55ab42a
SHA256

b5db3a7ec06ae9562fadc80af9692bf4012e86ecfe4991687c8b8be083722886
SHA512

8df5e25a5b9c77dac30cde1276e5e0701857b35425ab5746247f46a604f4c5aab9b42ab79aff00fa9440e58fe9bc9f958e8ab09b5de96b963999bf6dd4a3e289
SSDEEP

3072:DNpBfklPbKliu/auEPIFK/8kNBcn0Y5o40X7ljCusCfwAe0:DNQlOliuiu6x9ZYu7ljC/L0

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  b6c6e0ed6e5aa62baec8de42d2d8fee52df072c6a2b33530fbf8bc73d36309a9.exe
- Size
  
  269KB
- MD5
  
  b6698f73dd3bce2646f76c9589256455
- SHA1
  
  20f6bdd05ca92a1499fa6c0dab9954135bd2f194
- SHA256
  
  b6c6e0ed6e5aa62baec8de42d2d8fee52df072c6a2b33530fbf8bc73d36309a9
- SHA512
  
  0c4b6e7c103959576ebcc2a6e676a085a1d272d9bcb1de00b161644b7c0922cd1eb89b82e92b8ef32e35bdb21780c51bba5659ddaaf60968d1d3750d9618751c
- SSDEEP
  
  3072:5ArJBwHDu5z0XOs/AzR++VNX2VQXHtYOl07BBI60JOERR5vK7/TB2+xxdnPwZl4:kJBwPOs/mR+SNs7BJ0JOEDabhPdoZ
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2