Extracted

Extracted

• • Target

    8419cca489c02e8125879d791c9916df4a35645eba2a8cfacfa9663facb673d4

  • Size

    264KB

  • MD5

    1b435eb85a1d60aa9b92f6d614e8875f

  • SHA1

    33c0147d53e4b119fa061e66526bf74a9045aede

  • SHA256

    8419cca489c02e8125879d791c9916df4a35645eba2a8cfacfa9663facb673d4

  • SHA512

    8f4eaebea6dd557c5f0d4eb9d188b1d4bbe25ee5318f704e6c7b7fa794127e1f57a570d1b3ee28e773fcac1013b249c82aa297337d39b7b4dd75e02538cdd2a2

  • SSDEEP

    3072:qB67iEwpsSdEH+u+gT0PJY72J8PVtQTZ9YKzZRXCANVm9gVwn:qHtTaHcgTD72WPsZO+10+

  Score

  10^/10

  smokeloaderpub1backdoorbootkitpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2