Extracted

• • Target

    1339d8437b13ceca77e24912f9c3fe11e30b32f71bc7da03c4f86a4c8a218453.exe

  • Size

    163KB

  • MD5

    b4d551e1ae248fd9bbf157e5c8b9a1a9

  • SHA1

    adf99319734136d0c619dcbb089fa4d4743ae239

  • SHA256

    1339d8437b13ceca77e24912f9c3fe11e30b32f71bc7da03c4f86a4c8a218453

  • SHA512

    584fca9677747ccde53d82faca59938a5f353671eca9248f711e93b29852b8aa952ae6fc055107a4a1fc2c9e95bfa1f8adb1d4b38888c2a3bc09e29e189c741e

  • SSDEEP

    3072:Eakj1CJOHiPNYH5vuncNz5X2LMTXMmg8cmoxJ/1T:ERCe4Npyz5X2LpmgvmoJ/

  Score

  10^/10

  smokeloaderbackdoortrojansystembc

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2