Extracted

• • Target

    d31f7a4a68a38581a88a343cbc9be8480acdba021c3bca39f6d45c4cac352be1

  • Size

    352KB

  • MD5

    11d9e55a4cc32d18382d0428eb99a651

  • SHA1

    5d8d56e2743332e8184ac8c4724ee166387e1b54

  • SHA256

    d31f7a4a68a38581a88a343cbc9be8480acdba021c3bca39f6d45c4cac352be1

  • SHA512

    abc88024ca89676e8a6de77cd8eb6c4df17f34642b16163ccf814f86c72dbd5ecae6cd062fe180fb3e66227ec82b7ac52ae0fc8457c6c7cba66ee5e3ecc04684

  Score

  10^/10

  smokeloaderbackdoorpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1