Extracted

Extracted

• • Target

    bd25a7985cf82df98e5a22c414db8721f518ec0644d4e14fc39f26e72a8b02a9

  • Size

    222KB

  • MD5

    d3fa77e75c98071f54f9ff05bf1474f1

  • SHA1

    c8fd0d4a788837b1f27ffc40294afc3f69823d4f

  • SHA256

    bd25a7985cf82df98e5a22c414db8721f518ec0644d4e14fc39f26e72a8b02a9

  • SHA512

    6c6c7df4aad21f21585aa7295f999424403e2984cce56d742f11ca69e84659ebc40976413f80d913f2d977f75886085e59d84215564b0151d99d92d701b321fd

  • SSDEEP

    6144:r4FEL84Rdu9kS2JnyoSdFZN8KC0KuZYHWHXT:r42A4R89eyoSdFZN8KCmu2Hj

  Score

  10^/10

  smokeloaderup4backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2