Extracted

• • Target

    6958ACC382E71103A0B83D20BBBB37D2.exe

  • Size

    232KB

  • MD5

    6958acc382e71103a0b83d20bbbb37d2

  • SHA1

    65bf64dfcabf7bc83e47ffc4360cda022d4dab34

  • SHA256

    078f586ebb8a22305540fb5982b2521f1b82e4317f286e13bab680fff0a9d164

  • SHA512

    ebfa8b6986630b3502409d38cdff54881e4bce48511c7ba4f027345296c29708112c19ec6c9181c4b0188fa1f5cbe17b3c5d44dc07f33858323c677ef9caaeae

  • SSDEEP

    3072:FdfbYSFlTBL/A9OYh6++4hY7gfv9yPQxAVUmZAzsqvj1letKv/jbNRKCnrQbW:PbYSFH/AYYh9vERVUmSAQj1la9

  Score

  10^/10

  smokeloadertfd5backdoorpersistencetrojanupx

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1