smokeloader | 9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd | Triage

Resubmissions

25/03/2025, 15:40

250325-s4pk6ssjz3 10

05/02/2025, 09:14

250205-k7s4rszmex 10

26/08/2021, 08:49

210826-epqpjsdkt2 10

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 15:40

Sharing

Report Analysis Logs

General

Target

9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe
Size

174KB
MD5

badcc5eeb093cfa468ac2433ca3ec639
SHA1

1e9b7c068262b69803f40088d7c296ec1cad777c
SHA256

9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd
SHA512

9710efb850d7109bbb51a769ecf610e1c79732d331c140392b68448f3fca49249b1458cbf7e4e931056bc4987a605616052197f1003c68d0490f66ab6e25c611
SSDEEP

3072:PEzbsWM3VTFTXFm+Dc5v8e8Bap8QHwhZoWC9sI5/DuT61m:PYoJVBTh68fB68QHwhZU9sI5/

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe
C:\Users\Admin\AppData\Local\Temp\9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe bcdedit /set shutdown /r /f /t 2
1⤵
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/848-2-0x00000000001B0000-0x00000000001B9000-memory.dmp

Filesize
36KB

Download
memory/848-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/848-5-0x00000000001B0000-0x00000000001B9000-memory.dmp

Filesize
36KB

Download
memory/848-4-0x0000000000400000-0x0000000002CBB000-memory.dmp

Filesize
40.7MB

Download