smtpfu*ker

smtpfu*ker is an SMTP brute-force tool designed to test credential lists against mail servers. The operator provides a target mail server, a list of usernames, and a password list — the tool iterates through combinations and reports valid credentials. Standard brute-force mechanics with SMTP protocol support.

Capabilities

The tool occupies a support role in the kill chain: operators use it to find valid SMTP credentials on compromised hosts, then feed those credentials to mailers (Leaf, Viper, or custom scripts) for phishing campaigns. Valid SMTP credentials from a legitimate mail server are high-value — they provide delivery credibility that no rented infrastructure can match.

Total Opacity

The file is 18 KB of binary-encoded content with zero readable lines. No function names, no variable names, no comments, no string literals visible in the source. Static analysis is impossible without runtime deobfuscation — the encoding (whether PHPJiaMi or another commercial packer) reduces the entire tool to an opaque binary blob that PHP’s runtime decodes and executes.

This level of obfuscation is itself a finding. Free obfuscators (base64 wrappers, variable renaming, string encoding) leave structural traces — function call patterns, control flow, identifiable decode stubs. The smtpfu*ker encoding leaves none. The author either paid for commercial-grade source code protection or has access to a packing toolchain that produces equivalent results. Either way, they treat this tool as a product with value worth protecting rather than a disposable script.

The core function is SMTP credential brute-forcing — consistent with the tool’s name, its deployment context alongside mailers that need valid SMTP credentials, and the behavioral profile described in reporting. But the protected source may contain additional capabilities (callback beacons, credential exfiltration to the author, rate limiting logic, proxy support) that are not visible without deobfuscation. The 18 KB size is large for a simple brute-forcer, suggesting either embedded wordlists, multi-protocol support, or additional functionality beyond what the name implies.

Vulnerabilities

No vulnerabilities identified — static analysis impossible due to commercial-grade obfuscation. The tool’s protected source may contain additional capabilities not visible without runtime deobfuscation.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_smtpfuker {
    meta:
        description = "smtpfu*ker SMTP brute-force (PHPJiaMi-packed)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/smtpfu-ker/"

    strings:
        $phpjiami1 = "phpjiami" ascii nocase
        $phpjiami2 = "PHPJiaMi" ascii

    condition:
        filesize < 30KB
        and ($phpjiami1 or $phpjiami2)
}

Note: smtpfu*ker is wrapped with the PHPJiaMi commercial packer. A PHPJiaMi YARA hit is a triage signal, not a confirmation — the packer is used by many tools — so correlate hits with the behavioral indicators (outbound SMTP connections, brute-force bursts) before concluding.

MITRE ATT&CK

OHIIHO Threat Research.