Extracted

• • Target

    3cf0f56a8b601b0a8f0788b54b52160e4abbc3d77c1aedf079dec62630281868

  • Size

    317KB

  • MD5

    0e9407872c7b312c730e5dcc39009d81

  • SHA1

    5b2a44419599cc7ecfe85eea1aeb252869669e21

  • SHA256

    3cf0f56a8b601b0a8f0788b54b52160e4abbc3d77c1aedf079dec62630281868

  • SHA512

    958875c9c1cc32edf4ca72e8f94beec584c2ff937aab5688e89bed0adac81a35a0a20efa3d1f7148f872390e2723c630b3569a3db8fa2edc2b29a2e02cdb8326

  Score

  10^/10

  smokeloaderbackdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Sets service image path in registry

    persistence

  • Suspicious use of SetThreadContext

  behavioral1