Extracted

• • Target
    d05b0346c49a0f6fddc9cdf69245b617.exe
  • Size 160KB
  • SHA256 0bb3d0d83eb2f0f98af3bd6be5fe69658aec3cc0d7614f9cdc98b1ad76737d51
  • MD5 d05b0346c49a0f6fddc9cdf69245b617
  • SHA1 5ddef66513b2327bd7bbbc6b2deb24607c5a568c
  • SHA512 a3acf23a6102a4dfbf80f2987830134f0a3dfa9f2076a2a64196613ae980265e63637c941d00e87e604471edc04125b9049343ddd51984c3b7d08752403f36cc
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoortrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2