Extracted

Extracted

• • Target

    9ebc3628cb743003e47d3b3d007c37040801f0f1b0a7fb1830e26272e0f91efd

  • Size

    295KB

  • MD5

    cb7812ea338333093c6d0cf972e341c7

  • SHA1

    f92740f3e60873fc724e6f62a0dc5659b61ba7d6

  • SHA256

    9ebc3628cb743003e47d3b3d007c37040801f0f1b0a7fb1830e26272e0f91efd

  • SHA512

    5fa201338694d33cb310a55603a1ba754d02eed1e21149e8dd257ed76652bdb705261cc7c5be383721c0350b67c522726701a5bbefa1fd26e5f8cf5b7839ee2c

  • SSDEEP

    3072:GRMXS5zSj2L5s+JpkC+RDUMJrGtM/mokg4H+mluo8VeYBBiEg87dB:QISpSeZJpkC+RoMJgMOX8ml6VeYDg8Z

  Score

  10^/10

  smokeloaderup4backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1