Extracted

• • Target
    SecuriteInfo.com.W32.AIDetect.malware1.13347.26113
  • Size 301KB
  • SHA256 b9f3a45501f3b2bcff7c481546792f462bb2d49f06c8a7ed4b3599645c43f615
  • MD5 f8e46da8ada2e8cd36468df680203f0c
  • SHA1 179ca4fa4deeead8475901906bcec3a674d2271c
  • SHA512 c1c868de76867a28792458c58c7da3549c9e81901da6ba4002e697290ab874955983a1d4ef87a3eb2a00e509b5faf8a31430fc46b5e255647ce961ae39aa5350
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2