smokeloader | d5acc924425fbd84dafabacbed642628acee74582621b8d0c63a75650dca1c99 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 09:15

Sharing

Report Analysis Logs

General

Target

JaffaCakes118_1b1cb353957fe73e024db0372f71ff6c.exe
Size

233KB
MD5

1b1cb353957fe73e024db0372f71ff6c
SHA1

0020acff271c5e5c65574c7ea4dc62a79a864feb
SHA256

d5acc924425fbd84dafabacbed642628acee74582621b8d0c63a75650dca1c99
SHA512

66ca90a5b94d8c395bae47e67f296134539dcb777003d104b89b3667b6585a1f8c5fc055447b35f9312597258eddf411d06c5732902e280639406735dbd06d3b
SSDEEP

3072:yGxrYHhs5iU7HSKZOGmrsjaJBkqz5iNRKrnSbcOT+CNf4/AWaSkSJu98vd:GHhs5idKZ5SR5iNRKpAIADG8el

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b1cb353957fe73e024db0372f71ff6c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b1cb353957fe73e024db0372f71ff6c.exe"
1⤵
PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-0-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2284-1-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2284-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2284-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2284-5-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2284-4-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2284-3-0x0000000000400000-0x0000000002F01000-memory.dmp

Filesize
43.0MB

Download