smokeloader

General

Target

3be471ed6d998b4209f7e76928290181c1f7ce7c0e7627d7eb50dacf5f580da9
Size

28KB
Sample

240526-sggl2sbc99
MD5

8e3699fc59bec81d3be38a0f419526be
SHA1

ec26b0317c182dbc5469868abccc13466868a469
SHA256

3be471ed6d998b4209f7e76928290181c1f7ce7c0e7627d7eb50dacf5f580da9
SHA512

8afc1a096a88942b2cfdd4443f6f7bc535e92e9d9696ad6229b5e8a47e68eb53a87e86194bedfcc7bf1ca7e8567ab65589894d4e1b3c73e9a9c7752920e8eb9f
SSDEEP

768:09o2NBnLehTP1SdX0JKxG7wxAHQAW+iMsnppoH:z2NBShsdX0oU7AAHzi/poH

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2022

C2

http://dbfhns.in/tmp/index.php

http://guteyr.cc/tmp/index.php

http://greendag.ru/tmp/index.php

http://lobulraualov.in.net/tmp/index.php

rc4.i32

Targets

- Target
  
  febb01c58274dc2b7127823be1da06a8f9715bcef8c20ef480696d96e0ed7d7b.exe
- Size
  
  40KB
- MD5
  
  a1dec75a2b2f3c5abdf498a6c7c512c8
- SHA1
  
  fdb3b8eca89fc351bc9eee84b4489fc9a89452ef
- SHA256
  
  febb01c58274dc2b7127823be1da06a8f9715bcef8c20ef480696d96e0ed7d7b
- SHA512
  
  0c9c060083e3064124e49b3c13bcc39a44dac3939e7a4d33525f097c787938dd88aa8b179e8a90ea6fbebe5e243ac9c5412a6c6b9e379ba5ae20306be21afa2e
- SSDEEP
  
  768:yBQB1CTmqUQHXQkkU3NIZjKQu/MGQ2lsDBw7en:yBc0+yQmNIZreMp28O7Y
Score

10^/10

smokeloader pub2 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2