smokeloader | 428042434639c4df277f606a2a86e81785b8d8f35c9b78153ce70aa76e70885a | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 04:52

Sharing

Report Analysis Logs

General

Target

JaffaCakes118_8c494c5c46d9e31f5319628f3c301ece.exe
Size

232KB
MD5

8c494c5c46d9e31f5319628f3c301ece
SHA1

f1ca67c7bfd67601f296491aa683f7bf0be3cf5d
SHA256

428042434639c4df277f606a2a86e81785b8d8f35c9b78153ce70aa76e70885a
SHA512

43710a6b7014af1089182015fe00ab2b69a23fc5e4692692ad30b21bdcbdc834eb3ca3e77f7056eedc5d10fb945ae484f72e01b573e5448a03d521377728bf27
SSDEEP

6144:+USwfDB+j/4320BPB5eiJPNQ92N3IADG8el:+5wfli/43bxJ1D3xD

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c494c5c46d9e31f5319628f3c301ece.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c494c5c46d9e31f5319628f3c301ece.exe"
1⤵
PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3020-1-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/3020-3-0x0000000000400000-0x0000000002F01000-memory.dmp

Filesize
43.0MB

Download
memory/3020-4-0x0000000000400000-0x0000000002F01000-memory.dmp

Filesize
43.0MB

Download