smokeloader

General

Target

91713a00dd18d04d68a6b34ac3c20206f1bd38cfb72506ef32baadd380c3f993_dump.exe
Size

40KB
Sample

240526-py23jadf9s
MD5

a1dec75a2b2f3c5abdf498a6c7c512c8
SHA1

fdb3b8eca89fc351bc9eee84b4489fc9a89452ef
SHA256

febb01c58274dc2b7127823be1da06a8f9715bcef8c20ef480696d96e0ed7d7b
SHA512

0c9c060083e3064124e49b3c13bcc39a44dac3939e7a4d33525f097c787938dd88aa8b179e8a90ea6fbebe5e243ac9c5412a6c6b9e379ba5ae20306be21afa2e
SSDEEP

768:yBQB1CTmqUQHXQkkU3NIZjKQu/MGQ2lsDBw7en:yBc0+yQmNIZreMp28O7Y

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2022

C2

http://dbfhns.in/tmp/index.php

http://guteyr.cc/tmp/index.php

http://greendag.ru/tmp/index.php

http://lobulraualov.in.net/tmp/index.php

rc4.i32

Targets

- Target
  
  91713a00dd18d04d68a6b34ac3c20206f1bd38cfb72506ef32baadd380c3f993_dump.exe
- Size
  
  40KB
- MD5
  
  a1dec75a2b2f3c5abdf498a6c7c512c8
- SHA1
  
  fdb3b8eca89fc351bc9eee84b4489fc9a89452ef
- SHA256
  
  febb01c58274dc2b7127823be1da06a8f9715bcef8c20ef480696d96e0ed7d7b
- SHA512
  
  0c9c060083e3064124e49b3c13bcc39a44dac3939e7a4d33525f097c787938dd88aa8b179e8a90ea6fbebe5e243ac9c5412a6c6b9e379ba5ae20306be21afa2e
- SSDEEP
  
  768:yBQB1CTmqUQHXQkkU3NIZjKQu/MGQ2lsDBw7en:yBc0+yQmNIZreMp28O7Y
Score

10^/10

smokeloader pub2 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2