Extracted

• • Target
    DF734289KT.exe
  • Size 783KB
  • SHA256 33e30423aa49be107686f0ee537128f8cd5e30ab0f3dc5c543df8e34aa440067
  • MD5 14240914a71732c252930bd99eda9826
  • SHA1 1e1c359f425e8d1a9b5f887912a0d46b4cd55a19
  • SHA512 b43de9b3c83233f42311b8fa6a191203e5a3ef32eb827077b5e0217b76718484ccd4db4c685c17d58802f4ba66955aa4e1f1f59b31eb7faf11681b432aa6c416
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoorcollectiontrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Deletes itself

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2