smokeloader

General

Target

48d565173a19594e28a7525b9da5553bdd08e8e0a18a976b4fbd52d08970b4e9
Size

162KB
Sample

240417-qssscabb8y
MD5

96dd6804ba3cb016af903155f2559901
SHA1

957843a9ff5daceb63c8af69197e8714d025d4f6
SHA256

48d565173a19594e28a7525b9da5553bdd08e8e0a18a976b4fbd52d08970b4e9
SHA512

45bcc898446de4bb5338adbe1503db583975e0755a74701ba03de1d1df7cadf696accf4ca870a40d1757a38d2e8abb6382171c97f25e433d619860b1f1cdb860
SSDEEP

3072:nSoPYMGkEDviXDI6VomeFiYkteETlLNkO2E8o2CTQPExXT:dPY7VDv8fRsueETv7QPG

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  53a3ddba0b75161ce2d48cfe94f0b45371f879edcbf45756da50f729b664888c.exe
- Size
  
  316KB
- MD5
  
  53801a0bcd9199d21c20df467beee881
- SHA1
  
  1c0b7ebe21c9abac3416ed32b1238c8607090f4d
- SHA256
  
  53a3ddba0b75161ce2d48cfe94f0b45371f879edcbf45756da50f729b664888c
- SHA512
  
  e1a33b9d0c075e14589bf1753b711fac586a353ea798c9236d21d7c3cbb1e4de23343a123a1fcf903153f955d1b8b2a6614c6803ee23946914c741889b8ba1b4
- SSDEEP
  
  3072:z0iD5S2RZihP2+ccK+EXWkDo/jXnKw3MrMhLv1tmoL7XMwY1olXM4Q6d:FHON2ZW9n3M6vN7ZYi
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2