smokeloader

General

Target

18d44422c26b25bcd1cb1c51327d4ffed8b994f5e049a43327510a9e46d0288e
Size

144KB
Sample

240417-qz4s7abf7z
MD5

9efb16156689957f50614fb3f7bc9653
SHA1

ca933bfce617377a3da63fe77853977608fdc80c
SHA256

18d44422c26b25bcd1cb1c51327d4ffed8b994f5e049a43327510a9e46d0288e
SHA512

6fc0311f054cd8ec6091f74c4eb76481569dd8fc5f0a131acb12b925f9fee49bff812357013990c501b13e82e2a808d55f6834ddfafa3f3bacef66d6ff65fc5b
SSDEEP

3072:NnBjO0es5YqcszUDPOEFCzzwHPZlQZrTH5DlZVtqdT+g5PDjoyrGr:NBy0JYqf6GdnUjQlD5DDVtqdym3oy6r

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Targets

- Target
  
  91e8fd048fb5df071ba6e3d7917edcb53122d9cbd9e57dcf4b5e50c72d575c7a.exe
- Size
  
  259KB
- MD5
  
  e5477d6420e21e75a4bb411a3947201a
- SHA1
  
  7120bf0ba0196ecc8cc04dd0c3166185ee3f7892
- SHA256
  
  91e8fd048fb5df071ba6e3d7917edcb53122d9cbd9e57dcf4b5e50c72d575c7a
- SHA512
  
  de56dddda25e1cf9c5835613e38375f463bbcabe858b846077359b704493ef75b14e6187f21f110103bde70cc61efe17e5dac6d229456271b33afa3406c7020d
- SSDEEP
  
  6144:K7vq2CD3/WTO/Ukgn4olUKm4shprkwnf8/9tQ:ERM3/WTO/dgxUWshprDnatQ
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Downloads MZ/PE file

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2