smokeloader

General

Target

1b8c7c770e1105b0d96c8e30486955d37358930ed79d4b5434d5dd894da2d019
Size

242KB
Sample

240418-2a487sge39
MD5

f27255fbf7ddab80b8f9aa0fe62ecbd8
SHA1

afcb58b2823d6094fff4b15ada58aa3f695a6705
SHA256

1b8c7c770e1105b0d96c8e30486955d37358930ed79d4b5434d5dd894da2d019
SHA512

910aa92a48c390775f97753d5fd93e47416e4ac39b24123bd41d4eeebc96ee2ce83feb0083b8f2b1d4c22e16585000c1e383e16f8336928b4d42bfd29008b234
SSDEEP

3072:vCLPAPZuzMWzr6ZrTyOZv2t9rUdg5+76xbvJOQzCB44:KLGq6ZK6v2tZUZ74JOQA

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  1b8c7c770e1105b0d96c8e30486955d37358930ed79d4b5434d5dd894da2d019
- Size
  
  242KB
- MD5
  
  f27255fbf7ddab80b8f9aa0fe62ecbd8
- SHA1
  
  afcb58b2823d6094fff4b15ada58aa3f695a6705
- SHA256
  
  1b8c7c770e1105b0d96c8e30486955d37358930ed79d4b5434d5dd894da2d019
- SHA512
  
  910aa92a48c390775f97753d5fd93e47416e4ac39b24123bd41d4eeebc96ee2ce83feb0083b8f2b1d4c22e16585000c1e383e16f8336928b4d42bfd29008b234
- SSDEEP
  
  3072:vCLPAPZuzMWzr6ZrTyOZv2t9rUdg5+76xbvJOQzCB44:KLGq6ZK6v2tZUZ74JOQA
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2