smokeloader | 752ec1aa99094a1c2ab70274082e4b25fdc119aeea929d63dbe09683b010dfc6 | Triage

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 18:43

Sharing

Report Analysis Logs

General

Target

Trojan.Win32.GCleaner.ASGI.exe
Size

229KB
MD5

f5dea85673ce9dd544cba1f57acda760
SHA1

76db4caa56b2b6a48f0cae49128228bc1bc5a82f
SHA256

752ec1aa99094a1c2ab70274082e4b25fdc119aeea929d63dbe09683b010dfc6
SHA512

c4fe2870f40c1d98d877124e084d3e582b216f1e5ebada6884c7679df7b0dfa46e8dee0f1cf5364add18e13e445e0de97c1f1f960c83066b122cd26352e7b7e3
SSDEEP

6144:qND7vpIKBVoz3zy7DpUUzuQTdJbNnr3Z:4D7xIKoCUUzhdJbNnr3Z

Score

10^/10

smokeloader pub4 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.GCleaner.ASGI.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.GCleaner.ASGI.exe"
1⤵
PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-1-0x0000000002D00000-0x0000000002E00000-memory.dmp

Filesize
1024KB

Download
memory/1884-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1884-4-0x0000000000400000-0x0000000002B59000-memory.dmp

Filesize
39.3MB

Download
memory/1884-5-0x0000000000400000-0x0000000002B59000-memory.dmp

Filesize
39.3MB

Download