SMOKEDHAM
SMOKEDHAM is a lightweight .NET-based backdoor associated with UNC2465 and used in intrusions linked to DarkSide ransomware deployment. Reported delivery vectors include phishing emails and trojanized software installers, including malvertising-delivered installers and supply-chain style trojanized Nullsoft installers such as SmartPSS and SVStation. The malware’s source code has been described as embedded in its dropper as an encrypted string. SMOKEDHAM supports execution of PowerShell commands and arbitrary .NET commands received from command-and-control infrastructure, continuously captures keystrokes, captures screenshots of the victim desktop, and exfiltrates data to its C2 server. Its C2 traffic has been observed encoded with Base64. Observed post-compromise behavior includes modifying registry keys for persistence, enabling credential caching for credential access, facilitating lateral movement via RDP, enumerating local accounts with net.exe user and net.exe users, and creating user accounts. In a documented UNC2465 supply-chain intrusion, SMOKEDHAM used PowerShell to download a legitimate ngrok utility renamed conhost.exe from third-party file-sharing services, and persistence for the ngrok tunnel was established via VirtualHost.vbs added to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run under the WindNT value. That tunnel was used to expose remote desktop/UltraVNC traffic. Reported C2 hosts for SMOKEDHAM include max-ghoster1.azureedge[.]net, atlant20.azureedge[.]net, and skolibri13.azureedge[.]net. Additional indicators mentioned in the content include loader artifacts Gbdh7yghJgbj3bb.html (MD5 f075c2894ac84df4805e8ccf6491a4f4), another loader sample with MD5 05d38c7e957092f7d0ebfc7bf1eb5365, VirtualHost.vbs (MD5 84ed6012ec62b0bddcd18058a8ff7ddd), and the renamed ngrok binary conhost.exe (MD5 e3bc4dd84f7a24f24d790cc289e0a10f).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC2465 now uses phishing emails to deliver DarkSide via the Smokedham .NET backdoor. Smokedham also supports the execution of arbitrary .NET commands, keylogging, and screenshot generation.
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 techniqueInitial Access
2 techniquesUNC2465 now uses phishing emails to deliver DarkSide via the Smokedham .NET backdoor
sending a malicious Google Drive link delivering an archive containing an LNK downloader. More recent UNC2465 emails have used Dropbox links with a ZIP archive containing malicious LNK files
Execution
3 techniquesThe content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
Multiple examples of using built-in commands for discovery, e.g., “ver >> %temp%\download” and “systeminfo >> %temp%\download”, and “cmd /c systeminfo …”.
Smokedham also supports the execution of arbitrary .NET commands
Persistence
6 techniquesAcross the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
APT3 has been known to create or enable accounts, such as support_388945a0 . ... APT5 has created Local Administrator accounts to maintain access ... DarkGate creates a local user account, SafeMode, via net user commands.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
Operation Wocao enabled Wdigest by changing the HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest registry value from 0 (disabled) to 1 (enabled); Wizard Spider modified WDigest UseLogonCredential to 1 to force credentials to be stored in clear text in memory.
Privilege Escalation
2 techniquesThe content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
Stealth
1 techniqueDefense Impairment
2 techniquesAcross the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
Operation Wocao enabled Wdigest by changing the HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest registry value from 0 (disabled) to 1 (enabled); Wizard Spider modified WDigest UseLogonCredential to 1 to force credentials to be stored in clear text in memory.
Credential Access
2 techniquesSmokedham also supports the execution of arbitrary .NET commands, keylogging, and screenshot generation
Operation Wocao enabled Wdigest by changing the HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest registry value from 0 (disabled) to 1 (enabled); Wizard Spider modified WDigest UseLogonCredential to 1 to force credentials to be stored in clear text in memory.
Discovery
3 techniquesThe content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking admin status, and enumerating user sessions.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”
Lateral Movement
1 techniqueAquatic Panda modified the victim registry to enable the RestrictedAdmin mode feature, allowing for pass the hash behaviors to function via RDP. SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP). SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.
Collection
2 techniquesSmokedham also supports the execution of arbitrary .NET commands, keylogging, and screenshot generation
Smokedham also supports the execution of arbitrary .NET commands, keylogging, and screenshot generation
Command and Control
4 techniquesThe content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
“APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads… EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads… Bumblebee has been downloaded… from OneDrive… Operation Spalax… used OneDrive and MediaFire to host payloads… Raspberry Robin… payloads… on Discord servers.”
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
Exfiltration
1 techniqueADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stealthy backdoor used by UNC2465 for initial access, persistence, reconnaissance, lateral movement, and enabling extortion/ransomware deployment. It is delivered via trojanized installers (e.g., KeyStore Explorer, Angry IP Scanner), uses DLL side-loading and PowerShell obfuscation, manipulates Windows services (e.g., MSDTC) for persistence/privilege escalation, and communicates with C2 using techniques like domain fronting (e.g., Cloudflare Workers) to obscure traffic origins while executing arbitrary PowerShell commands and exfiltrating recon data.
Enterprise New Software: ... SMOKEDHAM
SMOKEDHAM is a .NET-based backdoor that provides remote access to compromised systems. It supports commands such as screen capture, keystroke logging, and execution of arbitrary PowerShell commands. It communicates with its C2 server using HTTPS and domain fronting, and uses RC4 encryption for command and data exchange. It is deployed via a PowerShell dropper and is used for persistence, lateral movement, and credential harvesting.
Smokedham is a .NET backdoor used to deliver DarkSide ransomware and provides capabilities including arbitrary .NET command execution, keylogging, and screenshot capture.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.