smokeloader

General

Target

91c0957754a739de2d2f15822833547947499d2c41f1ac0d7a604756d34d9c8f
Size

153KB
Sample

240417-qxca6abe21
MD5

0d89135834e07accc8b1903c257e2093
SHA1

613a71874905925bd23e877e09c54856fb4468a6
SHA256

91c0957754a739de2d2f15822833547947499d2c41f1ac0d7a604756d34d9c8f
SHA512

f06a40844d6a6294e98ce457fa60c7f86eaf61f0cd91ae3492f0b54fe61e9cae7f807dbf90a431b07e50db60339a54975981c070009f060aacf35908bc857509
SSDEEP

3072:Gr8BWvPGwFyviFQ9cOSJuxQyqNokCxAbudpf:6VPulM5vaL

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32

Targets

- Target
  
  dd412095728977133073e98b5d8d6b09ba65f6f7843f495663d9af1391a18483.exe
- Size
  
  267KB
- MD5
  
  8d497ad51a5e074060134dcb2d49786c
- SHA1
  
  a2519bbfcd1c1c4f5558df52caa038ce4cb97448
- SHA256
  
  dd412095728977133073e98b5d8d6b09ba65f6f7843f495663d9af1391a18483
- SHA512
  
  994ab1bcee306c42a7bcefa2c0f4747e5fb62359d2fc292084b370269ebaa2eb7fd37643d2b024dd8684ada4f8d1ec80110b219a8ab626a20ded2c82dc3cf84c
- SSDEEP
  
  3072:LBhoLytqNiryGxcInMp3/ZaBesq5GBrPKWZlhy8paIYWLXfag5Z34zT+yx:IERryGfnC/sM5irPK6hjtYCyQ34zT
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2