smokeloader

General

Target

8a020b93b0cc1df5c374d374c94e4536.exe
Size

262KB
Sample

240526-vahxmsdh43
MD5

8a020b93b0cc1df5c374d374c94e4536
SHA1

b8ccbc70d9e7ec9be33104ebccaaec75f156df27
SHA256

4f4168fb2f6ddf5742523a5e2fa7437b952edd01811f00c276f98d26b09fa61e
SHA512

8cacd60e3586a1412b981e252c5dbabcc5a040693e62be1f4a8ba3293ef5505c6897b09228caa30d540566cb737b5f12fdb17f27862e9d72b127fdf5c8922319
SSDEEP

6144:rMCSsy5RDZm5P5iWR68v+fqXybR4HT7LWT:rMD5Zm5hd68v+fWyyna

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://dbfhns.in/tmp/index.php

http://guteyr.cc/tmp/index.php

http://greendag.ru/tmp/index.php

http://lobulraualov.in.net/tmp/index.php

rc4.i32

Targets

- Target
  
  8a020b93b0cc1df5c374d374c94e4536.exe
- Size
  
  262KB
- MD5
  
  8a020b93b0cc1df5c374d374c94e4536
- SHA1
  
  b8ccbc70d9e7ec9be33104ebccaaec75f156df27
- SHA256
  
  4f4168fb2f6ddf5742523a5e2fa7437b952edd01811f00c276f98d26b09fa61e
- SHA512
  
  8cacd60e3586a1412b981e252c5dbabcc5a040693e62be1f4a8ba3293ef5505c6897b09228caa30d540566cb737b5f12fdb17f27862e9d72b127fdf5c8922319
- SSDEEP
  
  6144:rMCSsy5RDZm5P5iWR68v+fqXybR4HT7LWT:rMD5Zm5hd68v+fWyyna
Score

10^/10

smokeloader pub3 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2