smokeloader | d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd | Triage

Resubmissions

05-02-2025 09:14

250205-k7c3jszmdt 10

26-08-2021 07:15

210826-tcp94zce5e 10

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 09:14

Sharing

Report Analysis Logs

General

Target

d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe
Size

172KB
MD5

a8d41cdb1096e641af72ae7dfa954433
SHA1

492971020433977d73baa18080c5615fc28f6e9a
SHA256

d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd
SHA512

875f98193a106c6f241f1eda58e720dd2351a7dae1abe5dd312bb9127866d0e11c4a9130177dfaf197750f4eace1367489eb50515b3bac6c944ae39609b875a8
SSDEEP

3072:xIOZRGmcB+IC5xjfLeHwhZoWC9sI5/DuT61m:x1rGFkJjLeHwhZU9sI5/

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe
C:\Users\Admin\AppData\Local\Temp\d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd.exe dsrm -subtree -noprompt -c user"http://+:443"
1⤵
PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-1-0x0000000002D30000-0x0000000002E30000-memory.dmp

Filesize
1024KB

Download
memory/816-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/816-3-0x0000000000400000-0x0000000002CBB000-memory.dmp

Filesize
40.7MB

Download
memory/816-4-0x0000000000400000-0x0000000002CBB000-memory.dmp

Filesize
40.7MB

Download