Extracted

Extracted

• • Target

    bc083bddb24c32348299581c1d1051299dca6121ff44fc307baa59e2efe2d37c

  • Size

    231KB

  • MD5

    16c5ee40d5590e349c3a609ea831e6ae

  • SHA1

    71593a26dd56882b9af5a54c6194b8ef44e29f72

  • SHA256

    bc083bddb24c32348299581c1d1051299dca6121ff44fc307baa59e2efe2d37c

  • SHA512

    3251a3e677109c25cb4e02cf72406a78b43410a7b77645c17c0cc2297b51db6e03670f98818d50ba9839096d233b2dbf5929dc68a94e9cc07f9c9c152e42362f

  • SSDEEP

    3072:Wf/uT4vAYlhgpzygcW+qmiHyzRfujGx372IqJi7PXP398Ol:+pGtcWiVpQIb7PuO

  Score

  10^/10

  smokeloaderpub1backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2