smokeloader

General

Target

c71287e02c15899593f80c84f3cfb699c74d3fe6bdb90b3725b63b5335b9f75a
Size

160KB
Sample

240417-qfc65agg78
MD5

32cae154d52cd7839391c6f5c9de2035
SHA1

5c8b1c2c7e0de741094cb6bc682ac29ae61028b8
SHA256

c71287e02c15899593f80c84f3cfb699c74d3fe6bdb90b3725b63b5335b9f75a
SHA512

b80ae529d39d67e9e1273e23c69afccb8afe364955d8e885415f4c057cf2a2dd57afd51ea80763109ec4d08fa73d8edad82c9854099ab9e43133240cddf87318
SSDEEP

3072:kWxgaiDBAPpLhzXwhn2+Yn+O+ykcWSWaSeRKsMyGeHv0n/sCvsMjh4Kwk:hxwDkhzXwQfnOy+SWaSe4sZHv0/nvsMN

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  1efbc80ffd55c78287134a11add66b10bf7b2cd724913721a7f305d483050593.exe
- Size
  
  303KB
- MD5
  
  ceaa361db12c482e95a8b83e2de2af2f
- SHA1
  
  7288d4cfcea6a4e478354bb15f06d3af82ec9cfc
- SHA256
  
  1efbc80ffd55c78287134a11add66b10bf7b2cd724913721a7f305d483050593
- SHA512
  
  94ca0bc39bbdc92672215daf4df1c9d5d9e288bb6097eb8a147bf3816dda1b992d971faa39ed0ee5daf1e4b2cbeaf3ff5a683834e66d47c474f6591d711a0fbb
- SSDEEP
  
  3072:ZQzJkBHCgU0lpcWt+sNX2VYXSjNr6gYatNEnZnKZI6DOZWCwbUcP1KS:EkBPmWtt2rZYzyI6DOUCwb1Pw
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2