Extracted

Extracted

• • Target

    ca389b38fb88de27d8e6782f9642d98989af618e7d1af4cd6b8e5fc8eed31186

  • Size

    263KB

  • MD5

    5f8d526cc16823160c06593405a3b393

  • SHA1

    64b97251781b811078236469b999e61bde4563d0

  • SHA256

    ca389b38fb88de27d8e6782f9642d98989af618e7d1af4cd6b8e5fc8eed31186

  • SHA512

    ba5690e0b0288e9ca2d647a68f6927717ae77298e3037474386e2bbf3d0ea64c5f6be26bca4e9d995751291964ef8f5b6cea058b7c432dd7782890e91494f295

  Score

  10^/10

  smokeloadersystembcbackdoorpersistencesuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets service image path in registry

    persistence
  behavioral1