Extracted

• • Target

    897a1efb61e29a0486718dbdab8b0fe1b08b886745e2e21c1a1ddbc08e7e76f6

  • Size

    334KB

  • MD5

    1d3e9fe39151564f85cb3b38ad99704a

  • SHA1

    7c0b6685c0c9804b58da66b0d4a7c656f6b09c07

  • SHA256

    897a1efb61e29a0486718dbdab8b0fe1b08b886745e2e21c1a1ddbc08e7e76f6

  • SHA512

    59660a0e874dd8f9424881bc45c32bbeb0e11da842e22114909485e6dbfc2599b08252ed00e79307897e42281b91c3fe033933d2b46bd9743544476a490725b1

  Score

  10^/10

  smokeloaderbackdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Sets service image path in registry

    persistence

  • Suspicious use of SetThreadContext

  behavioral1