smokeloader

General

Target

c50936d837cf836e987c4631815e434442c3c42d8665373345645a074f62c10d
Size

152KB
Sample

240417-qzw4caaa88
MD5

d1ce5c3736b0b39561e0cae59a8c32aa
SHA1

5f16ce60ac10fcdf3195f7227122968816023ad3
SHA256

c50936d837cf836e987c4631815e434442c3c42d8665373345645a074f62c10d
SHA512

22a8643bb7581f5097462b5a2d22373d99616f2e4f60edde048a18c4882efad0a519f2455c196330171b9492ce0ccb935ea7b5829c57be4fbc07810dd395e7ee
SSDEEP

3072:ZD1/cSLALzAx2DediRPc0pLIeR4ATEVZh4QmYxhHFXioLUQaBHVTn:DcSW8Q7RPc4LIeKA4VZh4QfxhHoBHx

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32

Targets

- Target
  
  9e3f3d4b3afc4ce161869ac6a5e07ee0318b8d436602411bad6fad75549757dd.exe
- Size
  
  252KB
- MD5
  
  704dc68aee0f22c4c95ae6b7099d347b
- SHA1
  
  d7c613704fe7eda41ffefafb6bff9d92f0dc147a
- SHA256
  
  9e3f3d4b3afc4ce161869ac6a5e07ee0318b8d436602411bad6fad75549757dd
- SHA512
  
  02a00911e098c8126fb90ffc947a465eaa0b116ad74460e33aafcc50a86dec3e7fd9cd5bd92eeaff2f80c9c1d1672daad6730e9d349f880c7c709d348ffa7385
- SSDEEP
  
  3072:SQYuRgCFbFMRSRSbNW3fLTwlVE87RDZuhdWv1Pi1X/3g5J41TFyx:dFRMRykWPL800mhcQxvA41T
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2