Extracted

Extracted

• • Target

    407ac7d39aabbcbfae43375189046de28909935415f9bdc55dcd376566364f01

  • Size

    231KB

  • MD5

    5fe2c454689339965cc76b3f474ba9f0

  • SHA1

    132bb729590f7a9a202f5d827e1d88892cb80a75

  • SHA256

    407ac7d39aabbcbfae43375189046de28909935415f9bdc55dcd376566364f01

  • SHA512

    6ebdd3bfe198734651200ecd7536dad7029f258941e794df76b520074d18adcb268fe4b2f09e0c1addf86c28dc36a1b2c637df9aa48ae5780a47c25ac84a94c0

  • SSDEEP

    3072:OU6lAynH4YpRdK66A0W+pmrs5qB6wCopAsJPrtnlVARkEjscM5xaTWvK12qcD:g+SFkI0WO3paPnluGEjscyxLvK12qc

  Score

  10^/10

  smokeloaderpub1backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2