Extracted

Extracted

• • Target
    8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa.exe
  • Size 240KB
  • SHA256 8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa
  • MD5 817d3b2845b7869b9fc71086755bef75
  • SHA1 62afe642e08e778593a54c053af79cb2efecbe6b
  • SHA512 23fa2f5a78a1fcba86ec53b509d05fd8134a8d6466cf7aaffd7e39ef7ab812607eab0c40faea7512c4defdaa1c74ca7872504c5fae5597e3e0ae81bb990f453d
  • SSDEEP 3072:GHAEvKLe+EtqHInlgz3OWtd6IwYbF2u5u1SkLRaQedb:nL7EXlgzzOI3beUJ5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderpub1backdoorbootkitpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Deletes itself

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2