Extracted

• • Target

    0x000a000000015dad-102.dat

  • Size

    31KB

  • MD5

    2f15badba6517410d55efa1738f8af01

  • SHA1

    93259c2a88beb2efd789d2e175bb80550e73d3ad

  • SHA256

    f0411dadb92a7778d5e59d3226cef80bdab49e4796b524bbe13340826d30eb7c

  • SHA512

    e7e3a984e08c2c5a3ed4ee99f4f176219ae72ce38963a58d7a4505cbd82db2309742e2f61514755dbc621815ce2b8055c4f06a3a9f38eaa2cf0e86b755e8986e

  • SSDEEP

    384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW

  Score

  10^/10

  smokeloaderbackdoortrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2