smokeloader

General

Target

1f7f8333d4f36fbe60225ddde47c918305dd57855664319a991892b3a955aff0
Size

308KB
Sample

240501-2kvgrahe3t
MD5

1a67f64d92c1ff0a0820f43ac48762c2
SHA1

ddc80598b01dfb7d4aef6e71cc9a8ec5b27b2403
SHA256

1f7f8333d4f36fbe60225ddde47c918305dd57855664319a991892b3a955aff0
SHA512

7bc2380a92d12346bf6f56669866746a11d2aefacbf6bb3ec4a6f50e332e2055449491e83185087c49d61365f9a718a9a6d5f2a73d7c3feaba2c8ea2c2bf3f42
SSDEEP

3072:vDRGIThepBYb6iAc+J8GXIcs5WDknGzbjZghQRWdPUZvrut/wWF9vTkkZcl:y/Ybb1fPWD5zb2+ROZ1xyl

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  1f7f8333d4f36fbe60225ddde47c918305dd57855664319a991892b3a955aff0
- Size
  
  308KB
- MD5
  
  1a67f64d92c1ff0a0820f43ac48762c2
- SHA1
  
  ddc80598b01dfb7d4aef6e71cc9a8ec5b27b2403
- SHA256
  
  1f7f8333d4f36fbe60225ddde47c918305dd57855664319a991892b3a955aff0
- SHA512
  
  7bc2380a92d12346bf6f56669866746a11d2aefacbf6bb3ec4a6f50e332e2055449491e83185087c49d61365f9a718a9a6d5f2a73d7c3feaba2c8ea2c2bf3f42
- SSDEEP
  
  3072:vDRGIThepBYb6iAc+J8GXIcs5WDknGzbjZghQRWdPUZvrut/wWF9vTkkZcl:y/Ybb1fPWD5zb2+ROZ1xyl
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2