Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
_Overview SmokeLoader is a malware that generally acts as a backdoor and is commonly used as a loader for other malware. Attributed to the criminal group Smoky Spider, a group that uses SmokeLoader and Sasfis, loader and downloader respectively. SmokeLoader has been used as a bot in infrastructures and contains strong evasion capabilities as well as Anti-Analysis, Anti-VM and Anti-DBG techniques. _Technical Analysis SmokeLoader appears on systems usually through phishing,…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | host-file-host6.comhost-host-file8.comfiskahlilian16.toppaishancho17.topydiannetter18.topazarehanelle19.topquericeriant20.topxpowebs.gavenis.mltootoo.gaeyecosl.gabullions.tkmizangs.twmbologwuholing.co.ugquadoil.ru | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…