Extracted

Extracted

• • Target

    SecuriteInfo.com.Trojan.Crypt.25134.28955.exe

  • Size

    295KB

  • MD5

    b9f3ee34988cad6c59125dbe0f6e6c41

  • SHA1

    a667b7b8f663d65cb018945266a5dddfd24726f2

  • SHA256

    0d0bc2301d292058fbaa059a061b050a475f796c1856e5c1d53d179b790dabbb

  • SHA512

    23d35df319bf0539db8006e505227b86c783fd868d5e7d4aed0d2fb7679d0fcdbe0b59da4f262db30f2d1318357dfadd94a1020794dede2a61a279201c10796a

  • SSDEEP

    3072:7W3iHpCABkQsSgCcNaLm+00fWUWVxZIU4kwZ+0Zq4V8xUKS:q3iJCAkQsSgCrm+TOrVxZIU4ToCpy

  Score

  10^/10

  smokeloaderpub1backdoortrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2