Extracted

Extracted

• • Target

    784e3a535f623d7c59209e39bbdbd9ffabcc07157efbcaf12a8143190c08ed44

  • Size

    209KB

  • MD5

    487c5ef864db010745ea26e6c27cdf10

  • SHA1

    b285aecebee79d70f684832a2bb09467c6db6cfb

  • SHA256

    784e3a535f623d7c59209e39bbdbd9ffabcc07157efbcaf12a8143190c08ed44

  • SHA512

    8dfd0185117d909fca007e9bd53dcc90da54d8b2bccac265f8a963f46a5b05c0d38ef981531b441ae5b762632f28ec4a7b45293cb4d2d99235ec61c1add98a4c

  • SSDEEP

    1536:n3o311bC7Xu1LpopPim+PvDOmdVFnb0MLrR2mbU9EFJ0NxgVO1MGyF59vXMziEV0:4/MePP7rrRHbU9EFJ0YVj5GZH

  Score

  10^/10

  smokeloaderpub1backdoorpersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2