smokeloader

General

Target

c41d37c2d0cdf38429641c74c217248c787e4e0e499234806832d895fddeecba
Size

150KB
Sample

240417-qm8avaag9w
MD5

23ea49f2941c8c353514a79f2bf0fd8e
SHA1

fac79e3d91e295172059ebd2f87dc698ac34ec7b
SHA256

c41d37c2d0cdf38429641c74c217248c787e4e0e499234806832d895fddeecba
SHA512

9be014a84c18466c1098a1e2a06ee1078837cdd8977ba041ef40c452316ca1778cd6db7c1edb8525d54b7c5f2e11a0e78b60b652e81a7e81780ec6e3c7712acd
SSDEEP

3072:6gqYi10G5BqABeRhnQi8wJntmM0YlJmNbVfdQad1JFAPif+5:6NfBsnQiKEwJd7FAPz

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  b6c6e0ed6e5aa62baec8de42d2d8fee52df072c6a2b33530fbf8bc73d36309a9.exe
- Size
  
  269KB
- MD5
  
  b6698f73dd3bce2646f76c9589256455
- SHA1
  
  20f6bdd05ca92a1499fa6c0dab9954135bd2f194
- SHA256
  
  b6c6e0ed6e5aa62baec8de42d2d8fee52df072c6a2b33530fbf8bc73d36309a9
- SHA512
  
  0c4b6e7c103959576ebcc2a6e676a085a1d272d9bcb1de00b161644b7c0922cd1eb89b82e92b8ef32e35bdb21780c51bba5659ddaaf60968d1d3750d9618751c
- SSDEEP
  
  3072:5ArJBwHDu5z0XOs/AzR++VNX2VQXHtYOl07BBI60JOERR5vK7/TB2+xxdnPwZl4:kJBwPOs/mR+SNs7BJ0JOEDabhPdoZ
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2