smokeloader

General

Target

38d244a4340659fc2bc30648f233418b450078b8a7e0e903ef654675a0004a5b
Size

316KB
Sample

240425-b3qy6sda46
MD5

6453aec4930ec66f9810c36659876ed4
SHA1

0eb9a64cd4e43fbe41520757fbc5e28e333c0b0f
SHA256

38d244a4340659fc2bc30648f233418b450078b8a7e0e903ef654675a0004a5b
SHA512

bc70f19d57ec9797859307eebd62f4f9aec13d929c7fa8c3954695f4e916c3636073d100230d584504d309a12b29aa209ba6c23f65613f18d8272fab1f8942a6
SSDEEP

3072:BNOEU0lmsn2Dn6mdVocKMLFs+r0BxX3XY3S8tvKWWe15lX0nxX3c4RlvcE0znerN:6oleoc9Fs8w98p3bX0xX/cne

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  38d244a4340659fc2bc30648f233418b450078b8a7e0e903ef654675a0004a5b
- Size
  
  316KB
- MD5
  
  6453aec4930ec66f9810c36659876ed4
- SHA1
  
  0eb9a64cd4e43fbe41520757fbc5e28e333c0b0f
- SHA256
  
  38d244a4340659fc2bc30648f233418b450078b8a7e0e903ef654675a0004a5b
- SHA512
  
  bc70f19d57ec9797859307eebd62f4f9aec13d929c7fa8c3954695f4e916c3636073d100230d584504d309a12b29aa209ba6c23f65613f18d8272fab1f8942a6
- SSDEEP
  
  3072:BNOEU0lmsn2Dn6mdVocKMLFs+r0BxX3XY3S8tvKWWe15lX0nxX3c4RlvcE0znerN:6oleoc9Fs8w98p3bX0xX/cne
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2