smokeloader

General

Target

f84a6e2b551adb842a8901a71dc097d9_JaffaCakes118
Size

240KB
Sample

240418-sthpwagf96
MD5

f84a6e2b551adb842a8901a71dc097d9
SHA1

d6cd17a0f16c92df66cc5d290e68fb2130feee1b
SHA256

b33d94f74dd9d6f647409f4f1c83c097a913fb8c5e685f3d9b0fb6393b036501
SHA512

e9bdfca2c0d4111cc5a752d7a6c3779e51029177ee8e03e612dddb791f48abce3247b6495e144178bcef9208cef288803c699891ce9a34e0fb90bef6afe6cf67
SSDEEP

3072:sAdKwPtYMyg7IQSUCFfa0ab77yT5x/9Ymw9qlYDHuVnBEKdk+OJANhI15ht:sAAXMv7tQFf9/9YD9mSOX99O3T

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32

Targets

- Target
  
  f84a6e2b551adb842a8901a71dc097d9_JaffaCakes118
- Size
  
  240KB
- MD5
  
  f84a6e2b551adb842a8901a71dc097d9
- SHA1
  
  d6cd17a0f16c92df66cc5d290e68fb2130feee1b
- SHA256
  
  b33d94f74dd9d6f647409f4f1c83c097a913fb8c5e685f3d9b0fb6393b036501
- SHA512
  
  e9bdfca2c0d4111cc5a752d7a6c3779e51029177ee8e03e612dddb791f48abce3247b6495e144178bcef9208cef288803c699891ce9a34e0fb90bef6afe6cf67
- SSDEEP
  
  3072:sAdKwPtYMyg7IQSUCFfa0ab77yT5x/9Ymw9qlYDHuVnBEKdk+OJANhI15ht:sAAXMv7tQFf9/9YD9mSOX99O3T
Score

10^/10

smokeloader pub2 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2