smokeloader | dbb1ffb8a8b13b389fd8aff976808226333bc23d8aafc33111b88206f498fcea | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 23:07

Sharing

Report Analysis Logs

General

Target

e8b57e9e156ab02c1457cebbc8f0333f_JaffaCakes118.exe
Size

217KB
MD5

e8b57e9e156ab02c1457cebbc8f0333f
SHA1

1c2d52a55d84472067081a9e5b054f1d0dc7c35d
SHA256

dbb1ffb8a8b13b389fd8aff976808226333bc23d8aafc33111b88206f498fcea
SHA512

c67700539749b8ec3f96d42e8d64505fb9eaaed9a1f572813225e2c1f5de56f2b39eb9419058a0584454a163483ebb051c75887552920ae9f62607c6decd16e7
SSDEEP

3072:G0CRrgZraEceNQ8X0jBnCst5suV7YWn7HwanCNeoBNTfC8IU:zZraAO8X0c5u6W7CIwY8

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\e8b57e9e156ab02c1457cebbc8f0333f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8b57e9e156ab02c1457cebbc8f0333f_JaffaCakes118.exe"
1⤵
PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2280-3-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2280-1-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download
memory/2280-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download