smokeloader

General

Target

f9b33e95704a343204e509e2ed3160a14cd2dcd4cf23708ad1d34e98b9dbba6c
Size

153KB
Sample

240417-rk3g9ach5s
MD5

dbb34ce7beac56c67846d59e49f365df
SHA1

4a81633be7c98174808cddac74d1682adb1370b9
SHA256

f9b33e95704a343204e509e2ed3160a14cd2dcd4cf23708ad1d34e98b9dbba6c
SHA512

6a983751f31baccbed4691e8af313674e953b3feb8abbe3709fa2495c92de187c0cde2bbee49f313029fd1c3b4d9a16a43cb0ee1da405d0e43b7e7d1bf3d9b7e
SSDEEP

3072:FfA/qcXFQ6SHe93I1sECLEC8FEXp/zC06rfGb+OO9p+N5DremNiv2:FfBcKveFosbLT/XXsGI9wN5Dav2

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32

Targets

- Target
  
  dd412095728977133073e98b5d8d6b09ba65f6f7843f495663d9af1391a18483.exe
- Size
  
  267KB
- MD5
  
  8d497ad51a5e074060134dcb2d49786c
- SHA1
  
  a2519bbfcd1c1c4f5558df52caa038ce4cb97448
- SHA256
  
  dd412095728977133073e98b5d8d6b09ba65f6f7843f495663d9af1391a18483
- SHA512
  
  994ab1bcee306c42a7bcefa2c0f4747e5fb62359d2fc292084b370269ebaa2eb7fd37643d2b024dd8684ada4f8d1ec80110b219a8ab626a20ded2c82dc3cf84c
- SSDEEP
  
  3072:LBhoLytqNiryGxcInMp3/ZaBesq5GBrPKWZlhy8paIYWLXfag5Z34zT+yx:IERryGfnC/sM5irPK6hjtYCyQ34zT
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2