Extracted

Extracted

• • Target

    bfae14cb8929ce54e44b828341c59acc79d7144081abba2af8f366fc0ffb0a7a

  • Size

    329KB

  • MD5

    f70e8dd2590f47afe06473cdf9e474a3

  • SHA1

    107807555a4dab2511246fd0e0dfd301a5f3d8bd

  • SHA256

    bfae14cb8929ce54e44b828341c59acc79d7144081abba2af8f366fc0ffb0a7a

  • SHA512

    218a9e7fbf21b8d0409933810b9f847b846b523eec871182e4715ca02201a407c66b87c47b9d85c6f9b20417173e50f57404488c9af9eee35f9a9de7020fde9b

  • SSDEEP

    3072:JCS0xCZPqFrWeG1yNsgSD8bdjegoRfRl7C5zc02f5XyBk3eFx/RIAB:V9NwNsrwpegWDkwc5

  Score

  10^/10

  smokeloaderup4backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1