smokeloader

General

Target

4ad7c96f46c13f682b9eefaf535bfca560a97f40f68034e4790e51fd54ddf19d
Size

148KB
Sample

240417-qz5qgsbf71
MD5

292f50ad55cbf171d7b6467566dc84e4
SHA1

b0abe91bcaf70100b03631204994918ef3bc0e4f
SHA256

4ad7c96f46c13f682b9eefaf535bfca560a97f40f68034e4790e51fd54ddf19d
SHA512

8d0007330a1b4ba0bb828afe55e8f784faa5e189898d13cd78c877d7ee3870ad730a58d71fcb24e2f2e8b212cc5f6d0e590b4bc7b5eaa2bb538131c7c912aa3c
SSDEEP

3072:rW7wzPhsUP9U9BIbivZog7grmClOf5ICQ8xLSyNxG5Mce:ycDCUPimaZohxaInmLJv

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://sjyey.com/tmp/index.php

http://babonwo.ru/tmp/index.php

http://mth.com.ua/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Targets

- Target
  
  d5668d084d360bf8ce165fd50ef25b90a7211b9590ffcf4e96c51573df58d1ca.exe
- Size
  
  232KB
- MD5
  
  69a29dc302d7041a456b085daf7a13c2
- SHA1
  
  3844a972f5fa4c4e45450e3771df90f01fdea6a6
- SHA256
  
  d5668d084d360bf8ce165fd50ef25b90a7211b9590ffcf4e96c51573df58d1ca
- SHA512
  
  f131c003028af784f791a02d5e62419e68a848d88cf48fe4a355e824e3d09623b633467a1da998f87cc24693092ec6b26a1805f638fdcd74bfdf856397bd9fb7
- SSDEEP
  
  3072:Mt9eKRqiTn5HNXWlQ0lDrwdmCHPBbHJmQhOXs3RjX26zKbW:06ibdYldv8mCtpX
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2