Extracted

• • Target

    file.exe

  • Size

    183KB

  • MD5

    03e1befa49991fc477e5ae01b67070de

  • SHA1

    48117841d5cb73303a3004eaa613cb8d82ef1ced

  • SHA256

    c7c2e54acf6ef2957553c06322623811574476d51b9f09005e35803867b8b96b

  • SHA512

    ad621c0a66f7ed6e64ecca34daef9ec3d62ad240ae3ade9015b1829492aee0a249b549106ee9da0bc23ac7321f2bd39ddea163ac6b0c50bdb9031f1e5183a87b

  • SSDEEP

    3072:dexJOfoGr2L5LjeChfx556/PJYNsK9Szx5co4hSRjsLK2pI8OJ:debAzr2FLCChF62NsKwRjsxpI8O

  Score

  10^/10

  smokeloaderbackdoortrojansystembcdiscovery

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2