smokeloader | 4d8da0c2c62e4aad911adb993946095e0cef731b9c73d30ab4aa809d3c214dad | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 21:23

Sharing

Report Analysis Logs

General

Target

108da5938ef489f68d59889d9f97c93a_JaffaCakes118.exe
Size

303KB
MD5

108da5938ef489f68d59889d9f97c93a
SHA1

f0707794d8a4939b9b796c56bbe74fbec7ee3f2d
SHA256

4d8da0c2c62e4aad911adb993946095e0cef731b9c73d30ab4aa809d3c214dad
SHA512

17fada7210db89e659b5f6e9113426d3b1a4245960000d2089446e3be02bae063e89ce912dcd3f036c76f52a56609dcf5e068c6204de5ddb540cca7102a42932
SSDEEP

6144:c+tUNNTYXr1tSJq1c5wpvhRWCyn3thcgDxD9fE0pYjPpWskzFu:jUN9YXr1tD1cGRW/Ig1RsnpWskBu

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

C:\Users\Admin\AppData\Local\Temp\108da5938ef489f68d59889d9f97c93a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\108da5938ef489f68d59889d9f97c93a_JaffaCakes118.exe"
1⤵
PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/1016-4-0x0000000000400000-0x0000000000902000-memory.dmp

Filesize
5.0MB

Download
memory/1016-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download