Extracted

Extracted

• • Target

    150e9ffdac7f2361c2efa735929aa268.exe

  • Size

    776KB

  • MD5

    150e9ffdac7f2361c2efa735929aa268

  • SHA1

    3ed43e5fb5cd202d91fe31c4a0f8674e5fdb0759

  • SHA256

    d54259b35ece6e39b159317128bfd62f88abbaadd92537379c4bae078e82fe69

  • SHA512

    a56ef522fab3213f2f1d5a15d92615f0a039bf8f8c113e36e38f254b6d58185e5aa0449384d15ac52f1f6ac8d07159ac05d245926fba14ac61462e0911cb39a3

  • SSDEEP

    24576:pMwUwtgszGQgXxHjejMOlF3NdRruHycftxFA:pMwhd0SZlp/YtTA

  Score

  10^/10

  smokeloaderbackdoortrojanpub2

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2