smokeloader

General

Target

c166b490846d441400727765dd668262087642bae1bbfd7aaf7a1bed5aa35b62
Size

234KB
Sample

240526-hzdm1aah8v
MD5

73ddf9a7f42e0452b6aa00f4e0a0afd5
SHA1

79ea2d473e72751803c9650ae5c6b144a0aa4879
SHA256

c166b490846d441400727765dd668262087642bae1bbfd7aaf7a1bed5aa35b62
SHA512

c7931368fffeb684c6de5a7affe168f11c1e1d5fed5f843fb0ff98f393c49909e202fb7d500f126097f5e5ddf69beb1fe900c27bd918c2d8d4a69c451b053ed5
SSDEEP

3072:a5My9dAbFfJ30bYKMy+WlmKwkGLVmWDju8Ogxsqtoe8MGRT8:UUbFfJEb7LM5t9OgfdaRT

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://dbfhns.in/tmp/index.php

http://guteyr.cc/tmp/index.php

http://greendag.ru/tmp/index.php

http://lobulraualov.in.net/tmp/index.php

rc4.i32

Targets

- Target
  
  c166b490846d441400727765dd668262087642bae1bbfd7aaf7a1bed5aa35b62
- Size
  
  234KB
- MD5
  
  73ddf9a7f42e0452b6aa00f4e0a0afd5
- SHA1
  
  79ea2d473e72751803c9650ae5c6b144a0aa4879
- SHA256
  
  c166b490846d441400727765dd668262087642bae1bbfd7aaf7a1bed5aa35b62
- SHA512
  
  c7931368fffeb684c6de5a7affe168f11c1e1d5fed5f843fb0ff98f393c49909e202fb7d500f126097f5e5ddf69beb1fe900c27bd918c2d8d4a69c451b053ed5
- SSDEEP
  
  3072:a5My9dAbFfJ30bYKMy+WlmKwkGLVmWDju8Ogxsqtoe8MGRT8:UUbFfJEb7LM5t9OgfdaRT
Score

10^/10

smokeloader pub4 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2