Extracted

• • Target

    9aba44e14d29d0d83dab4445c4fba9ae41fc914dc544b44cce4a4d11b7a85764

  • Size

    312KB

  • MD5

    f3c43f777e940a212cce90ae833d96fd

  • SHA1

    b4f8b2c8c405369c7c69414140347c63ae2522d9

  • SHA256

    9aba44e14d29d0d83dab4445c4fba9ae41fc914dc544b44cce4a4d11b7a85764

  • SHA512

    0b1069acdbb3969f61ac9a605f1706971ae445a08f9575dde91134cfd126700e6fc79acef1ffc5a612e15c0948af9bfdc0909bb2a690a2b0f19e80140bec8b51

  • SSDEEP

    3072:c1iz3BJ7zLaST29CG5goUAplavWlZ/QJf3a8CgZZvCdxIxmUGHZlKIBkuyABcY9/:1z3DLLqOo6elZYt9PvvCHkGHPl6SBGc

  Score

  10^/10

  smokeloaderbackdoorpersistencepyinstallertrojan

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1