Extracted

• • Target

    5980c4aae31565e95b76b3150f92344edcdd8b84c5c7059afb804e0df14532bd

  • Size

    239KB

  • MD5

    3485f107a03b76035e7bdc254119f11e

  • SHA1

    c7eec65666ddfe3527e35a56340a3e630e027b76

  • SHA256

    5980c4aae31565e95b76b3150f92344edcdd8b84c5c7059afb804e0df14532bd

  • SHA512

    8a72b13adb28f78322137214d40ea5da98b85b338cdf76cc2afc615381c0b77ccc25a093f7ab975c6336ab91014158dea37b5617b2c3558004fa609ac22632ed

  Score

  10^/10

  smokeloaderbackdoorevasionpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence
  behavioral1