smokeloader

General

Target

fa0511e527d0c0d0dcedc75eb0692d6a_JaffaCakes118
Size

239KB
Sample

240419-lk6l1seg6w
MD5

fa0511e527d0c0d0dcedc75eb0692d6a
SHA1

050847bca7d2002b511de6ad6bb7618b28bb72f3
SHA256

a0b0c633f4f7ec05da532cbf4e26727f630bd09e0e6322c57dc963e50d80c9e1
SHA512

2eaa455521d376ad5cd1a07b90824bfff640663d633fe10fdae9ac53440ae39f0f4d8013cd8f8fc89d396a1442e07b460b0c10f3d93b5a6cd0909e320d663b99
SSDEEP

3072:bNb12IXVg0oat6uNzMfrY/jWIPt6BzgL00vySX10grTca0K/VQvxB708w:bNb12wy0RtlUE/KIPyzRgrTLEn70

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32

Targets

- Target
  
  fa0511e527d0c0d0dcedc75eb0692d6a_JaffaCakes118
- Size
  
  239KB
- MD5
  
  fa0511e527d0c0d0dcedc75eb0692d6a
- SHA1
  
  050847bca7d2002b511de6ad6bb7618b28bb72f3
- SHA256
  
  a0b0c633f4f7ec05da532cbf4e26727f630bd09e0e6322c57dc963e50d80c9e1
- SHA512
  
  2eaa455521d376ad5cd1a07b90824bfff640663d633fe10fdae9ac53440ae39f0f4d8013cd8f8fc89d396a1442e07b460b0c10f3d93b5a6cd0909e320d663b99
- SSDEEP
  
  3072:bNb12IXVg0oat6uNzMfrY/jWIPt6BzgL00vySX10grTca0K/VQvxB708w:bNb12wy0RtlUE/KIPyzRgrTLEn70
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2