Extracted

• • Target

    7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70

  • Size

    352KB

  • MD5

    4a8f313059f16223ed50fe0e4a376883

  • SHA1

    820d6c0564839a6b4e5c067ff3d323ca1ec0f441

  • SHA256

    7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70

  • SHA512

    58c840e99dbb39b07e27f56466e0068b18a6787d5534f273a6a8056c795e234e9428a671afc589170928452241ee41289483c7567e4731ff24e4c88de21b1fb8

  Score

  10^/10

  smokeloaderbackdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Sets service image path in registry

    persistence

  • Suspicious use of SetThreadContext

  behavioral1