Extracted

• • Target

    971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849

  • Size

    334KB

  • MD5

    1c03d828f8851eca3faa34e9fc7fc202

  • SHA1

    18309ec6c815702007e405e89834e2a06973b0ee

  • SHA256

    971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849

  • SHA512

    5b0e4cadf471a562b3f0df08c6fd3870b4e1c454029bde23186cd6cb2b6dfa8d4278d2fb1c15bb9baa3126df7cf1ea3fb55d6923d6ec486e65ac824269bdee09

  Score

  10^/10

  smokeloaderbackdoorevasionpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence
  behavioral1