Extracted

Extracted

• • Target

    32f238f4d46cc8bc50f8b635199e426438ff9ba894ce5120ad931e11a1dec485

  • Size

    753KB

  • MD5

    21884164c40ed182195005228c032538

  • SHA1

    dd51fef15bfc4d2fe024427ede3ffca274594e37

  • SHA256

    32f238f4d46cc8bc50f8b635199e426438ff9ba894ce5120ad931e11a1dec485

  • SHA512

    1d694c00330c6fec201f571c0decbeb125fdb90f203e28c9c927b997d1c04a6cb84625148f8f1f94ffb487cd217c22b7cd423241e536cdc0f426ab5d79d98d6a

  • SSDEEP

    12288:8MwNHnV+ztWlIbp7HOTW0AC5x52I+m7n3lwXqhtFpBC/lZKfKY39pNaUiOp66w7s:8MwNmWAyTW45nJn1++tFjalZxKLJh

  Score

  10^/10

  smokeloaderpub3backdoortrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2