smokeloader | 13cea9cb7d24d578d0d242f213e3e9d86f4a056b56c24f0c876be2a754d1edcf | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 12:42

Sharing

Report Analysis Logs

General

Target

94bce42dcb8a2f54fd6382c949f763bf_JaffaCakes118.exe
Size

214KB
MD5

94bce42dcb8a2f54fd6382c949f763bf
SHA1

1e5212db6519277d84a70723cee7ff9fd152cd42
SHA256

13cea9cb7d24d578d0d242f213e3e9d86f4a056b56c24f0c876be2a754d1edcf
SHA512

f50cd25660430f5d00bd3657141e2039f68f6f8a04f9bbfb07a5d3da4596fdf3bbd0b1a373991e9ee219b541e52b24481af538222a122aa7ea23a106ad20eb9a
SSDEEP

3072:KnV2C/m6Z3XGt5TwcptVWT2ScsYh6gSVywo3c+:bC/mE+rW17knGyHM

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\94bce42dcb8a2f54fd6382c949f763bf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94bce42dcb8a2f54fd6382c949f763bf_JaffaCakes118.exe"
1⤵
PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2644-2-0x00000000001B0000-0x00000000001B9000-memory.dmp

Filesize
36KB

Download
memory/2644-1-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/2644-5-0x00000000001B0000-0x00000000001B9000-memory.dmp

Filesize
36KB

Download
memory/2644-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2644-4-0x0000000000400000-0x0000000002C6C000-memory.dmp

Filesize
40.4MB

Download