smokeloader | 648a5f6831922deda3a9ed5d0386a33218455a9946eaf74b1f9bdbb2da6c3993 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/12/2024, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf4bacaad2c5940949aaf9d0048ad846_JaffaCakes118.exe
Size

223KB
MD5

cf4bacaad2c5940949aaf9d0048ad846
SHA1

bf6cfba26490c4c1d60f5a04801e6ef2a0bd53c3
SHA256

648a5f6831922deda3a9ed5d0386a33218455a9946eaf74b1f9bdbb2da6c3993
SHA512

2da45fa3239c140984112f3c57ffd9582b1399fec415cba54a6594b843bc19e10c200690a852a641d1c960b87c21901755436716f5c1145bb4d979226ba05179
SSDEEP

3072:HX2790PT4uMxpNM2+IXei5uy7YWnWnCNeoBxG/bob:3t4uMhFeddWWCIwA

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\cf4bacaad2c5940949aaf9d0048ad846_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cf4bacaad2c5940949aaf9d0048ad846_JaffaCakes118.exe"
1⤵
PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2568-2-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2568-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download
memory/2568-5-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download