smokeloader

Sharing

Copy URL

Twitter E-mail

General

Target

ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd.exe
Size

322KB
Sample

240626-b4d11axbje
MD5

1bcb9d8ba02bdbe8dcdb08f369228e0b
SHA1

b5e2e532ef2813e0cdbc3e124d7dd90e41495ec0
SHA256

ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd
SHA512

b1892eab7210cdec06d425bce13b7c066cda3863951bbd62f85dd362084c3bd5d35fee428bc46882b8787ae4877f51522665efef79c27e5c7192db9bd5aed298
SSDEEP

3072:cqWLOU/jAxIOG+1o1VFbBFeRC5xat4LtzCX1Ek1EJxTEqS:cBLd/jwFnGNBFau68KNH

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://movlat.com/tmp/

http://llcbc.org/tmp/

http://lindex24.ru/tmp/

http://qeqei.xyz/tmp/

rc4.i32

Targets

- Target
  
  ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd.exe
- Size
  
  322KB
- MD5
  
  1bcb9d8ba02bdbe8dcdb08f369228e0b
- SHA1
  
  b5e2e532ef2813e0cdbc3e124d7dd90e41495ec0
- SHA256
  
  ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd
- SHA512
  
  b1892eab7210cdec06d425bce13b7c066cda3863951bbd62f85dd362084c3bd5d35fee428bc46882b8787ae4877f51522665efef79c27e5c7192db9bd5aed298
- SSDEEP
  
  3072:cqWLOU/jAxIOG+1o1VFbBFeRC5xat4LtzCX1Ek1EJxTEqS:cBLd/jwFnGNBFau68KNH
Score

10^/10

smokeloader pub1 backdoor trojan
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Deletes itself

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2