Rewterz Threat Alert – SmokeLoader Malware – Active IOCs

Severity

Medium

Analysis Summary

Smokeloader is a popular bot and a veteran in its field, this piece of malware is used mainly for loading other malicious software, usually obtained from a third party. At the same time, it has the capability of loading its own modules, allowing it to conduct a variety of actions without the usage of external components. The seller of Smokeloader (which is known by the handle SmokeLdr) is active in providing this malware as a service to this date.

Impact

• Information Theft
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• ecebcfb4709df4fd437cac2d5f14cb05
• 7c3cb980063fc0ccf876dce8dc72d209
• 13f28d2ed8323bbbca9f2804f9763503
• 2c25677594d9f6c2e50ade274357d4e6

SHA-256

• 9a7f4d4d2c440b8009781e82023e52e122d77c584ff7bef19002a29e3b918efd
• c5e6a4a2d7ac5cdac2143d9021bea6bd82976804f6ffb3385e6962691b8c5f20
• 0537e5b579951c5fcbd64fbf11bb1b0ea70bd9d7984896b5893ba64d06597d6a
• 218ae2e9ccd0d778ca78c7aa8e9fd7101819507d0f9da4bfbc40687063bd7fd4

SHA-1

• 3aab7c184d965c66e23ebe9b281a897512a8d4bc
• 1cdce7a77f0589ae2839acccc7438252807978fe
• 501000c9e16939a15c539794f8cd6bcbaa53b350
• cd3cfda94dbfc0e6cb2f8f1e0740503eed4505f1

Remediation

• Exercise caution when receiving messages from unknown senders.
• Block all threat indicators at your respective controls.
• Keep your software updated to the latest patches.
• Search for IOCs in your environment.