smokeloader | 065b657a5177115ebbce711679d1b5b4161cef9f2a532d770afb06d6ed4abd84 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 10:09

Sharing

Report Analysis Logs

General

Target

12e54eb47a6f1fd3a3a7122928b9ef78_JaffaCakes118.exe
Size

223KB
MD5

12e54eb47a6f1fd3a3a7122928b9ef78
SHA1

162bb7541d25c7c80cba52a1dbcf88e12f914013
SHA256

065b657a5177115ebbce711679d1b5b4161cef9f2a532d770afb06d6ed4abd84
SHA512

cf7187f19a6211151c1967df1f3103b53217cac88fe4ec3a9f49647a24d31c7789edf52c2d4851a26040404f714bab36fdc845f136512155ceef57104dbc3480
SSDEEP

3072:mAfQT4fqnI9aApOQCJU1VNCuICdjk45+w7YWnWnCNeoBeTo/Y3b:xqnI9awOXJ6mU5kvbWWCIwR

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

C:\Users\Admin\AppData\Local\Temp\12e54eb47a6f1fd3a3a7122928b9ef78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12e54eb47a6f1fd3a3a7122928b9ef78_JaffaCakes118.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1488-2-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Filesize
1024KB

Download
memory/1488-1-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download
memory/1488-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download
memory/1488-5-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download