Extracted

Extracted

• • Target

    8e6e4b930b79cb66ece296d8bacc0225db53b48f362508dcc5e335b254055a7f

  • Size

    301KB

  • MD5

    531a942a943d149dd615d07a566cd06b

  • SHA1

    3112979189a6922f0090731dd1660299a0416afb

  • SHA256

    8e6e4b930b79cb66ece296d8bacc0225db53b48f362508dcc5e335b254055a7f

  • SHA512

    034b6db05a0805eacb26e18b6151fccf19496d9f7e48b23d235ee7fc3c30f9c9bb13fd4281f74c008d41da14b4e26a9efca674a1a5e74488733e16b83d058c3b

  • SSDEEP

    3072:KoF324VAoovHMp7WCC75csFtCDLpaD49uJbyeO8J:pGnoovH07h6cg8LpU49WI

  Score

  10^/10

  smokeloaderup4backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2