smokeloader

General

Target

717dca32c68e5c761aba4708fbaf9caab4fdc0d8af95209d2a49adef896fb9f0
Size

152KB
Sample

240417-rk7f7sch5y
MD5

4dbd5944ea8e2c41bc638d7f3ac8aab2
SHA1

48ec2bb1c4315e96afbdce64301ca8976479e7e3
SHA256

717dca32c68e5c761aba4708fbaf9caab4fdc0d8af95209d2a49adef896fb9f0
SHA512

2af78a04c0b492e9450ac521a37d5a12f6cc81a1ad203022d51e54ff26b3ee98f03c009b3e3c8acf9123249d6b4f884f9c8935fd67473bcb86a92d98663ed3c2
SSDEEP

3072:zehnzIoz6frg6ietneEeZWu27dd91eTxXJ+2XXyB+hOVqdzHtSOeAe9ZwW7L1:mcozGrg6neEdu27+TxZ+f8OizhgZ/B

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32

Targets

- Target
  
  9e3f3d4b3afc4ce161869ac6a5e07ee0318b8d436602411bad6fad75549757dd.exe
- Size
  
  252KB
- MD5
  
  704dc68aee0f22c4c95ae6b7099d347b
- SHA1
  
  d7c613704fe7eda41ffefafb6bff9d92f0dc147a
- SHA256
  
  9e3f3d4b3afc4ce161869ac6a5e07ee0318b8d436602411bad6fad75549757dd
- SHA512
  
  02a00911e098c8126fb90ffc947a465eaa0b116ad74460e33aafcc50a86dec3e7fd9cd5bd92eeaff2f80c9c1d1672daad6730e9d349f880c7c709d348ffa7385
- SSDEEP
  
  3072:SQYuRgCFbFMRSRSbNW3fLTwlVE87RDZuhdWv1Pi1X/3g5J41TFyx:dFRMRykWPL800mhcQxvA41T
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2