Extracted

Extracted

• • Target

    cf368a0dcd8c500377e410c9a6cb6ca9_JaffaCakes118

  • Size

    288KB

  • MD5

    cf368a0dcd8c500377e410c9a6cb6ca9

  • SHA1

    809f73cb05846c71a4d19f56aefc615da668b3a4

  • SHA256

    f11c745bfde92f5640916c304a0efd0985a1c479303461a7615b1d9d7d121ae2

  • SHA512

    0807b2ab4e986477c37157fce84c9dbc3bff2254f79256839aa7e11370b070eb197d389bd7e9c99439c351d1465555d1094247f85d20784924bb0a2d31f0cfb3

  • SSDEEP

    6144:LM4YYLchmOA9qGyvdaRRhmqH5rUW2sn70gmzMu9:LfYYLumOAEZGrgsuF9

  Score

  10^/10

  smokeloadervgubackdoordiscoverytrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2