Extracted

• • Target
    tmp
  • Size 695KB
  • SHA256 92016b01f6a319dece11785543f6ec734a436ba63727a8ae065890dfd4b6420d
  • MD5 d4cd7f24da8930bfc263c6fcd063c4cc
  • SHA1 6f08c420fcae55a3eb281f03b6bc63ad2eb025b8
  • SHA512 500d2cdbdcec195eeb455c3e34c9780dd3c0bf105730a78a890066d733b8646ffdccf8b302a48557b11a2547eda46261ef90dc46e499233115aa5a9e7b5891d0
  • SSDEEP 6144:mQ606xBwuSRDF2FXbmXzMT4teeBWHYpePla37v/OFKTMvC+vax5ZEorjy7+eQMAh:J1/2FX6XzMT47kPgLHOFPJX7D4Xn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloadersmokeloaderbackdoordownloadertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Deletes itself

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2