Extracted

Extracted

• • Target

    9a0541f97e1222ebd509fca35c7da412a715a386799292b9d80ab4b510f0203e

  • Size

    256KB

  • MD5

    e8f66ae6141f24aab9daebaf11f97bc7

  • SHA1

    e9b5e9bb6e17ae7dce9676fddca7596f7a21e5a1

  • SHA256

    9a0541f97e1222ebd509fca35c7da412a715a386799292b9d80ab4b510f0203e

  • SHA512

    9a7759559e544cd1bfda9329f41473419162ee445d2589600600e342b3b9d3e2624d6fc8f4bc4a3b8aea3aaf49f5a9c1b22cc0c6ad30eb41aae5c9486277e056

  • SSDEEP

    3072:5PUWLC15TTNyHAs0YMRqbAuRn8PLvcXYRBNQc7ovb9P4+:5ryTTA/blnPsNQQM2

  Score

  10^/10

  smokeloaderup4backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1