Extracted

Extracted

• • Target

    8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa.exe

  • Size

    240KB

  • MD5

    817d3b2845b7869b9fc71086755bef75

  • SHA1

    62afe642e08e778593a54c053af79cb2efecbe6b

  • SHA256

    8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa

  • SHA512

    23fa2f5a78a1fcba86ec53b509d05fd8134a8d6466cf7aaffd7e39ef7ab812607eab0c40faea7512c4defdaa1c74ca7872504c5fae5597e3e0ae81bb990f453d

  • SSDEEP

    3072:GHAEvKLe+EtqHInlgz3OWtd6IwYbF2u5u1SkLRaQedb:nL7EXlgzzOI3beUJ5

  Score

  10^/10

  smokeloaderpub1backdoorpersistencetrojanvmprotect

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Detects executables packed with VMProtect.

  • Downloads MZ/PE file

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2