smokeloader | 00169bddf9e9803502d64a34a1344407e8cda4a9933834452fea7522a213763b | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 20:09

Sharing

Report Analysis Logs

General

Target

JaffaCakes118_ed0f0a8f76dc993475ef31ba3b2e755f.exe
Size

145KB
MD5

ed0f0a8f76dc993475ef31ba3b2e755f
SHA1

209a973b09e1eeb28f4b7d5b157d1bf379609ace
SHA256

00169bddf9e9803502d64a34a1344407e8cda4a9933834452fea7522a213763b
SHA512

de67d962927055e10d3322163880f06ed3bcf3b91478e95be3fbf2a4616305d85bcb639ab7772ac72ea1e926b2edd731f217f6949f17b400effd9e75843d4267
SSDEEP

3072:pFgmEStDDsdDk/FqkfK8Q1ehasjjsk5UCzrS9H6l:p6mESFDlFNn3Ea

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed0f0a8f76dc993475ef31ba3b2e755f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed0f0a8f76dc993475ef31ba3b2e755f.exe"
1⤵
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-1-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/2172-2-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2172-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2172-5-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2172-4-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download