smokeloader

General

Target

2.exe
Size

234KB
Sample

240526-s2wayacc24
MD5

4d956ba3709b6be0cc4910690ef93f0b
SHA1

699a84b4e11844653e1d0cf90d9efda870d737fd
SHA256

91713a00dd18d04d68a6b34ac3c20206f1bd38cfb72506ef32baadd380c3f993
SHA512

21aac4778a9daa054f1b2fde63854d93cff419f62ccf1eb77a584c8560bbdfac39f07b7df70399be1250ec2dc856c053901206edfacdba706bb844cec6dddf7f
SSDEEP

3072:25BjyAijBcIXby+Gl7BVqlrovGJnVAS+CamnIys7TEkA8C7uT8:EajBxm74OGeCao2rA8CKT

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2022

C2

http://dbfhns.in/tmp/index.php

http://guteyr.cc/tmp/index.php

http://greendag.ru/tmp/index.php

http://lobulraualov.in.net/tmp/index.php

rc4.i32

Targets

- Target
  
  2.exe
- Size
  
  234KB
- MD5
  
  4d956ba3709b6be0cc4910690ef93f0b
- SHA1
  
  699a84b4e11844653e1d0cf90d9efda870d737fd
- SHA256
  
  91713a00dd18d04d68a6b34ac3c20206f1bd38cfb72506ef32baadd380c3f993
- SHA512
  
  21aac4778a9daa054f1b2fde63854d93cff419f62ccf1eb77a584c8560bbdfac39f07b7df70399be1250ec2dc856c053901206edfacdba706bb844cec6dddf7f
- SSDEEP
  
  3072:25BjyAijBcIXby+Gl7BVqlrovGJnVAS+CamnIys7TEkA8C7uT8:EajBxm74OGeCao2rA8CKT
Score

10^/10

smokeloader pub2 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4