SmokeLoaderMalware
- dofoil
- sharik
- smoke loader
The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft[.]com, bing[.]com, adobe[.]com, and others.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
6 of 26 · each with the sentence it comes from- T1014Rootkit
“hxxps://victorbush.com/2015/04/the-anti-rootkit-rootkit/”
- T1027Obfuscated Files or Information
“Defense EvasionT1027.007 – Obfuscated Files or Information: Dynamic API Resolution”
- T1027.006HTML Smuggling
“HTML smuggling > ZIP > JavaScript > CMD > DLL”
- T1027.007Dynamic API Resolution
“…es to evade detection and harden analysis, including system checks, indirect syscalls, encryption of next-stage and strings, and dynamic API resolution.”
- T1033System Owner/User Discovery
“DiscoveryT1033 – System Owner/User Discovery”
- T1036Masquerading
“…t operator regularly changed the impersonated brands to evade detection from cybersecurity vendors, and eventually realised that this masquerading technique was not effective.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
ErrTraffic: A Growing ClickFix Malware Distribution Framework“SmokeLoader).”
-
PikaBot: a Guide to its Deep Secrets and Operations“…e to disrupt criminal services, notably through taking down key botnet infrastructures, including those of IcedID, SystemBC, PikaBot, SmokeLoader and BumbleBee.”
Indicators in its reports
named in the reports above- flare[.]ioin 1 report
- chatgpt-web[.]vipin 1 report
- llc-image-ico[.]clickin 1 report
- 96.178.187[.]175in 1 report
- 96.181.156[.]219in 1 report
- 172.59.242[.]93in 1 report
- 68.60.174[.]238in 1 report
- a3f8b2c1d4e5f607…930a1b2c3d4ein 1 report
- be61936de03f3842ee814fd80a10233ain 1 report
- webanalytics-cdn[.]sbsin 1 report
- antigravity[.]studyin 1 report
- defi-xstocks[.]vipin 1 report
- 959da0fb174a8e4d…76a2f43c0f25in 1 report
- data[.]datain 1 report
- lordless[.]namein 1 report
- resonancessewars[.]tiresin 1 report
- alkaliesnonperspective[.]fishin 1 report
- demonising[.]liin 1 report
- callipersoutane[.]comin 1 report
- issuer[.]countryin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.