SmokeLoader — 3d638fa0a4c17eb3ebbef857da2b5dac.exe [2540f6f9]

Tehdit Degerlendirmesi

Bu ornek, hedef sisteme ek zararlı yazılım yuklemek amacıyla tasarlanmis moduler bir yukleyici (loader) olarak tespit edilmistir. Bankacılık trojanları, fidye yazılımları veya diger ikinci asama yukler indirebilmektedir.

Tespit Edilen Yetenekler

• Payload Indirme
• Surec Enjeksiyonu
• Kalicilik
• Anti-Analiz
• Sifrelenmis Iletisim

MalwareBazaar Etiketleri

Analiz Notu

Bu ornek SmokeLoader ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.

SmokeLoader — マルウェアプロファイル

SmokeLoader. autoruns.exe Sysinternals version info spoofing. Spaso developer PDB username. stub.pdb loader project artifact.

マルウェアの種類

Loader

プログラミング言語

C

C2プロトコル

HTTP

標的システム

Windows

別名 (AKA)

Dofoil

技術詳細

SmokeLoader (Dofoil/Smoke Bot) is a modular loader/downloader active since 2011. Primary function: download and execute additional payloads (Emotet, TrickBot, FormBook, Ursnif). Heavy obfuscation: string encryption (RC4+XOR), process injection via APC, code injection. Heaven's Gate technique: switches from 32-bit to 64-bit mode to evade WoW64 hooks. Anti-analysis: CPUID-based VM detection, process listing for analysis tools, timing checks. Uses process hollowing to inject into explorer.exe or svchost.exe. C2 communication: RC4-encrypted HTTP POST requests with bot ID, campaign ID. Sold as pay-per-install (PPI) service on underground forums (~$400/1000 installs). Frequently updated to bypass detection, >100 variants documented.

アトリビューション / 脅威アクター

Unknown (sold on underground forums, multiple operators)

機能と挙動

Payload İndirme

Süreç Enjeksiyonu

Modüler Mimari

Kimlik Bilgisi Hırsızlığı

Yanal Hareket

Kalıcılık

Anti-VM/Sandbox

İkincil Payload Dağıtımı

IOCリスト (2 件の指標)

IOC — SmokeLoader コピー

# SHA256 2540f6f96c7686299fcd27c4e17a9191e107b4e65a7c32ed1d290775e96d9bd1 # MD5 3d638fa0a4c17eb3ebbef857da2b5dac

タイプ	値	メモ
sha256	2540f6f96c7686299fcd27c4e17a9191e107b4e65a7c32ed1d290775e96d9bd1
md5	3d638fa0a4c17eb3ebbef857da2b5dac

C2サーバー (このファミリーで5台のサーバーを記録)

アドレス	タイプ	ポート	プロトコル	ステータス	国
80.66.75.36	ip	80	HTTP	inactive	RU
148.72.171.175	ip	80	HTTP	inactive	US
91.243.44.247	ip	8888	HTTP	inactive	RU
185.173.35.16	ip	8080	HTTP	inactive	RU
torcavpcs1.atitech.com	domain	443	TCP	inactive	—

C2アドレスはKEYDALチームが手動で検証したマルウェア検体のみに基づいて提供されています。商用利用は禁止です。