smokeloader | 5064a6271758035c76d00aa0de2b285e549097564e60deb2eea8782bbb788bae | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/11/2024, 09:16

Sharing

Report Analysis Logs

General

Target

5064a6271758035c76d00aa0de2b285e549097564e60deb2eea8782bbb788bae.exe
Size

214KB
MD5

5b412378d38ad96100526b0389e54de5
SHA1

224e3d9392213a73ec04c2930c6fdd4c48d3501a
SHA256

5064a6271758035c76d00aa0de2b285e549097564e60deb2eea8782bbb788bae
SHA512

e85182539c73fb4d4ffe4fcfa3f1f948e2db87a20b1b8cb85481c79ad5b8b5ee5022fdf5d34bd513bd8f37f914c412183d3427ec0e00bfa6b971c6077f147059
SSDEEP

3072:qTPcZc7pWdQDqrIQkT68RX3vuSGpB1l4e5S3W5cMlAOnMs:qF7cdQDqMDT68dfuSQ3EI

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\5064a6271758035c76d00aa0de2b285e549097564e60deb2eea8782bbb788bae.exe
"C:\Users\Admin\AppData\Local\Temp\5064a6271758035c76d00aa0de2b285e549097564e60deb2eea8782bbb788bae.exe"
1⤵
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-1-0x0000000002F80000-0x0000000003080000-memory.dmp

Filesize
1024KB

Download
memory/3048-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3048-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3048-3-0x0000000000400000-0x0000000002B39000-memory.dmp

Filesize
39.2MB

Download
memory/3048-5-0x0000000000400000-0x0000000002B39000-memory.dmp

Filesize
39.2MB

Download