smokeloader | 4730579d06899f3bb5391270c30879b20a0e2cc7aaa0e24ab7a88f69e2877449 | Triage

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16/09/2024, 18:20

Sharing

Report Analysis Logs

General

Target

Trojan.Win32.GCleaner.ASGI.exe
Size

229KB
MD5

f59dc1c335258d5de9ee910766474850
SHA1

9853ea0685b8bd42ec6b87fbb1e5bdbbc4ec7624
SHA256

4730579d06899f3bb5391270c30879b20a0e2cc7aaa0e24ab7a88f69e2877449
SHA512

748c173534fef5978aeff77b6c7862ce98e09c6891ad9ce71126091412fbdbd7537a236cbcc2c667b29306a9cd4e3ae8edbdcb80f5515b72fe5e0645d0f6a552
SSDEEP

3072:nN+T5o2dc3+RNPshJW3PQrS2XOBZUTNdUmvuQTdzZ/peZmQtjy4f:nN+T5oKcK5sL+QrS2XDbuQTdJEZmQZ

Score

10^/10

smokeloader pub2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.GCleaner.ASGI.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.GCleaner.ASGI.exe"
1⤵
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-1-0x0000000002C20000-0x0000000002D20000-memory.dmp

Filesize
1024KB

Download
memory/1520-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1520-3-0x0000000000400000-0x0000000002B5A000-memory.dmp

Filesize
39.4MB

Download
memory/1520-4-0x0000000000400000-0x0000000002B5A000-memory.dmp

Filesize
39.4MB

Download
memory/1520-5-0x0000000000400000-0x0000000002B5A000-memory.dmp

Filesize
39.4MB

Download