Extracted

Extracted

• • Target

    432b0b91e01efb4a9cd4a23f6d0de4e7c2b7c5d9349b85d661c4475bfe115f86

  • Size

    303KB

  • MD5

    f720d5284b6ffb2f05f17fd168ac3bb5

  • SHA1

    3989933110f4929de0301397ade9a695296aa037

  • SHA256

    432b0b91e01efb4a9cd4a23f6d0de4e7c2b7c5d9349b85d661c4475bfe115f86

  • SHA512

    5567c31c3f40cb48736bf18c7705effaecfde5ec97fbbe2ee94aff98a17c1a94e7f8867e8572a181012eabc3ca69e1c94e3912d84bdaa6e43efeecdf83d39620

  • SSDEEP

    3072:kzPuD9przKb72w0rkvw+HHebmTc4OQon8tJu64ofEy+qQzYVOuCjRQ1HELNrI7IH:95hzxnVCeKgL8t464oV+FNunpELJpV

  Score

  10^/10

  smokeloaderpub1backdoorbootkitpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2