smokeloader

General

Target

6f10b393cce45b5c3577807c50b70a5588e91d0cd34baeb0d076a40ee8003a44
Size

306KB
Sample

240418-2nz7eaha53
MD5

306d0cd6a237f6dae1c0ec607b2e97d0
SHA1

7fee6b8194fa3d033aade901b7f03b10e76396e6
SHA256

6f10b393cce45b5c3577807c50b70a5588e91d0cd34baeb0d076a40ee8003a44
SHA512

6569c63ef188b9b5fb24f28ccf7dee7078f593baa4dc33828f45cfc3b074583f2c63b474bdb79339c4bc9180199619e3628f4061c64b590a76f6b7509cf2b5c0
SSDEEP

3072:VwbYjWiTjh1G98pNWPu+jnmYb+IMqvSNdo5A3i9ihThBC6oR6AJHK7z/dZjwJmIB:VWiPGg+nXb+NiIBC6E6AJQfCewswkv

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  6f10b393cce45b5c3577807c50b70a5588e91d0cd34baeb0d076a40ee8003a44
- Size
  
  306KB
- MD5
  
  306d0cd6a237f6dae1c0ec607b2e97d0
- SHA1
  
  7fee6b8194fa3d033aade901b7f03b10e76396e6
- SHA256
  
  6f10b393cce45b5c3577807c50b70a5588e91d0cd34baeb0d076a40ee8003a44
- SHA512
  
  6569c63ef188b9b5fb24f28ccf7dee7078f593baa4dc33828f45cfc3b074583f2c63b474bdb79339c4bc9180199619e3628f4061c64b590a76f6b7509cf2b5c0
- SSDEEP
  
  3072:VwbYjWiTjh1G98pNWPu+jnmYb+IMqvSNdo5A3i9ihThBC6oR6AJHK7z/dZjwJmIB:VWiPGg+nXb+NiIBC6E6AJQfCewswkv
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2