Extracted

Extracted

• • Target

    9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483.exe

  • Size

    203KB

  • MD5

    7b2592bee2a2b4cfb28502892c619612

  • SHA1

    c4477fef847e926783d54efb7c577fdb8d2407f9

  • SHA256

    9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483

  • SHA512

    c9527802e2d80f8f226471fc1d0791dea2efc29e51eba03c2525defc6d6be41e8b8f2bcf1ecf30c543a9476d520ef53ab898b912a1a69086b83cc0bb5d28c1fe

  • SSDEEP

    3072:dDoO2LbVS5fgevom6PJiMrt+NqaDD3LP2uHv49GriBditdi16kwxZRUiaD:S3LbfGMTI3LPJPqG2Bkeia

  Score

  10^/10

  smokeloaderpub1backdoorevasiontrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Deletes itself

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2