smokeloader | 9bc38b4f2aee402aa59fd81af85859bc6f345a43eaf7c14343273525134a90b9 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 23:14

Sharing

Report Analysis Logs

General

Target

c9d9cba3f3008c9e4a9d81402dfed99a_JaffaCakes118.exe
Size

229KB
MD5

c9d9cba3f3008c9e4a9d81402dfed99a
SHA1

66f618841b4d4360a57699e92ed7afcbba8ba61b
SHA256

9bc38b4f2aee402aa59fd81af85859bc6f345a43eaf7c14343273525134a90b9
SHA512

ef94ed8adeec798065b17c39c8179eeda9932c9175ecf018a81e5effa872302e62687516d56013aa91fa6e6ada0c6891c235c2c13452c9d65c26cf97e16e07bd
SSDEEP

3072:5iRPdOgYeQx3MzYBoCC55m+7YWnWnCNeoB+xNgoob:3gYfx8zYBkyhWWCIwo

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\c9d9cba3f3008c9e4a9d81402dfed99a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c9d9cba3f3008c9e4a9d81402dfed99a_JaffaCakes118.exe"
1⤵
PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-3-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/3020-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3020-4-0x0000000000400000-0x0000000002C6F000-memory.dmp

Filesize
40.4MB

Download
memory/3020-5-0x0000000000400000-0x0000000002C6F000-memory.dmp

Filesize
40.4MB

Download