smokeloader | 0c063a204ce318c31549e3a23a6a1fd7eb87ae0d57af4aa302c795493ba094c8 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 11:32

Sharing

Report Analysis Logs

General

Target

JaffaCakes118_18491d30550e90d94f860117e35a7463.exe
Size

259KB
MD5

18491d30550e90d94f860117e35a7463
SHA1

344ebfb9247839468754e67047af7e160c4ad998
SHA256

0c063a204ce318c31549e3a23a6a1fd7eb87ae0d57af4aa302c795493ba094c8
SHA512

507dc461b6a70fa9dac232d93acff8368a7bf7eb4af9920a47a7e771574bca2c12e21a84982f960deb3c8fd02ceef4d619ab68031c503750e64268c2c78df35f
SSDEEP

6144:kwSxHMZThWKZ3dA7hItP5ADOqX7tNfVXVHQLIiu8cfo0/pW:dSxHiThl3dA72kKwZGEX8cA0/M

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_18491d30550e90d94f860117e35a7463.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_18491d30550e90d94f860117e35a7463.exe"
1⤵
PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-1-0x0000000003080000-0x0000000003180000-memory.dmp

Filesize
1024KB

Download
memory/2552-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2552-4-0x0000000000400000-0x0000000002F0B000-memory.dmp

Filesize
43.0MB

Download
memory/2552-5-0x0000000000400000-0x0000000002F0B000-memory.dmp

Filesize
43.0MB

Download