Extracted

Extracted

• • Target

    83236868049cc27a74a54ef2300893c81bd360fe97f17b9b442ff8f641ae4749

  • Size

    259KB

  • MD5

    546697c3749efd2b5ba241724a22480e

  • SHA1

    86b9659d59cc7fa90eda170a87cb0002d5c31161

  • SHA256

    83236868049cc27a74a54ef2300893c81bd360fe97f17b9b442ff8f641ae4749

  • SHA512

    09b7d3c3f6fc3a862b388e7553019e058982f9fcbfc3813bd4213235997ed7919af135813520b4c08d88fb80f375dcf146b5fdbc4fec26c5d21796ad5719a922

  • SSDEEP

    3072:JiqEK1HRFasHhmVzwuOXG0rqnx81+AXo9q/Et+UHlmmgSP/SDP6cPB:4wZzaShc/OXfWxjo/8+UHF3Z

  Score

  10^/10

  smokeloaderup4backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1