Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
Smoke Loader Analysis Smoke Loader , software introduced in 2011, is primarily utilized for loading subsequent stages of malware onto systems, particularly information stealers designed to extract credentials through various means. Its widespread acclaim can be attributed to its advanced Anti-Analysis and Anti-debugging techniques, along with its stealthy behavior, which poses challenges for detection. Notably, Smoke Loader employs consistent efforts to obfuscate its Command…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://rixoxeu9.top/game.exe | High | Score 58/100 | First seen |
| URL | http://telegatt.top/agrybirdsgamerept | High | Score 58/100 | First seen |
| SHA1 | c6ba6e91d40aa1507775077f9662ecb25c9f0943 | Medium | Score 53/100 | First seen |
| SHA256 | ab2c8fb5e140567a6e8e55c89138d5faa0ef5e6f2731be3c30561a8ce9e43d29 | Medium | Score 53/100 | First seen |
| URL | http://185.215.113.68/fks/index.php | High | Score 58/100 | First seen |
| SHA256 | daa69519885c0f9f4947c4e6f82a0375656630e0abf55a345a536361f986252e | Medium | Score 53/100 | First seen |
| SHA256 | 60c65307f80b12d2a8d8820756e900214ad19a1fcfcda18cdbee3a25974235ac | Medium | Score 53/100 | First seen |
| SHA256 | 4cd9af3b630e3e06728b335c2a3a5c48297a4f36fb52b765209e12421a620fc8 | Medium | Score 53/100 | First seen |
| URL | http://planilhasvbap.com.br/wp-admin/js/k/index.php | High | Score 58/100 | First seen |
| URL | http://95.217.43.206/ | High | Score 58/100 | First seen |
| SHA1 | b450eb89d7ea250547333228e6820a52f22babb2 | Medium | Score 53/100 | First seen |
| SHA256 | 8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…