MITRE ATT&CKsoftware (malware)
S0649 SMOKEDHAM
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.2
- Created
- 2021-09-22
Description
SMOKEDHAM is a Powershell-based .NET backdoor that was first reported in May 2021; it has been used by at least one ransomware-as-a-service affiliate.
Related
Uses · MITRE ATT&CK (21)
- T1098.007 Additional Local or Domain Groups sub-technique
- T1027.009 Embedded Payloads sub-technique
- T1598.003 Spearphishing Link sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.004 Domain Fronting sub-technique
- T1132.001 Standard Encoding sub-technique
- T1564.002 Hidden Users sub-technique
- T1204.001 Malicious Link sub-technique
- T1059.001 PowerShell sub-technique
- T1087.001 Local Account sub-technique
- T1056.001 Keylogging sub-technique
- T1136.001 Local Account sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1033 System Owner/User Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
- T1102 Web Service technique
- T1105 Ingress Tool Transfer technique
- T1112 Modify Registry technique
- T1113 Screen Capture technique
References
- https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html FireEye SMOKEDHAM June 2021
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html FireEye Shining A Light on DARKSIDE May 2021