smokeloader | 9e82d402e4e45f9e77c7f5d88405385a85c5010bea069b359c08c628c1e2d741 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 03:32

Sharing

Report Analysis Logs

General

Target

fe44e28dcec8b08fa61a5ae4552ba4e3_JaffaCakes118.exe
Size

239KB
MD5

fe44e28dcec8b08fa61a5ae4552ba4e3
SHA1

47cf60dc247c29d24de4d1aa7840dbd0c5e10602
SHA256

9e82d402e4e45f9e77c7f5d88405385a85c5010bea069b359c08c628c1e2d741
SHA512

89ae66828b3ceba57957181b227c97a1d33f331581db8360649c034ae68c2e423098a2f72e1d74d3e06081488cb8a94eda69f852a3b89bc6c432c5963ef6113c
SSDEEP

3072:RMqj4mtGh/5DgnIQXoCMXES0al77ylY5pPADCGxgClvHZkBFKXFTGgK0YP:RdjXi58ntJMXE1oIyqBkBFU8gK0Y

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\fe44e28dcec8b08fa61a5ae4552ba4e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe44e28dcec8b08fa61a5ae4552ba4e3_JaffaCakes118.exe"
1⤵
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-1-0x0000000000400000-0x000000000086C000-memory.dmp

Filesize
4.4MB

Download
memory/1704-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1704-2-0x0000000000A10000-0x0000000000B10000-memory.dmp

Filesize
1024KB

Download
memory/1704-4-0x0000000000400000-0x000000000086C000-memory.dmp

Filesize
4.4MB

Download
memory/1704-5-0x0000000000400000-0x000000000086C000-memory.dmp

Filesize
4.4MB

Download