smokeloader

General

Target

f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118
Size

203KB
Sample

240419-dgx7gafh5z
MD5

a2dfd2f2415ea68079e23e7556b7dc0e
SHA1

43a08afc2797f44720d05190960ca7425426f334
SHA256

f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0
SHA512

0e72f5e46b67b1723dda9931307a5cf919e3ea5d3a4bda1b3f5528f9c95027ccebe076dc7e58b628646fe2a68d0088b3d62d3d68aa4cf0ae7c80ff9572e349a2
SSDEEP

3072:iwKO2LMVS5fgevom6PJiMrt+NqaDGngsYrBp8OBwpssGnJyYK+p16jxZRU9SD:63LMfGMTxFYP8xpsrJyY0C9S

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://gxutc2c.com/tmp/index.php

http://proekt8.ru/tmp/index.php

http://mth.com.ua/tmp/index.php

http://pirateking.online/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Targets

- Target
  
  f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0_JaffaCakes118
- Size
  
  203KB
- MD5
  
  a2dfd2f2415ea68079e23e7556b7dc0e
- SHA1
  
  43a08afc2797f44720d05190960ca7425426f334
- SHA256
  
  f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0
- SHA512
  
  0e72f5e46b67b1723dda9931307a5cf919e3ea5d3a4bda1b3f5528f9c95027ccebe076dc7e58b628646fe2a68d0088b3d62d3d68aa4cf0ae7c80ff9572e349a2
- SSDEEP
  
  3072:iwKO2LMVS5fgevom6PJiMrt+NqaDGngsYrBp8OBwpssGnJyYK+p16jxZRU9SD:63LMfGMTxFYP8xpsrJyY0C9S
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2