Extracted

• • Target

    e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0

  • Size

    334KB

  • MD5

    005e445db353075922c066d7a792f78f

  • SHA1

    79aa6671076b491c0b016275161e6145b7a7a7c1

  • SHA256

    e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0

  • SHA512

    d355882916d84b8b848394851bd48f9ed74d6c715f09efe0e25b1e392e1bc148d683dc3ef5bb2aa80654bba7f7361c1d9d541b777c81b3f5e02dce3cd251d29a

  Score

  10^/10

  smokeloaderbackdoorevasionpersistencesuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence
  behavioral1