Extracted

• • Target

    d066367754599c6e684b76a890881b8d_JaffaCakes118

  • Size

    158KB

  • MD5

    d066367754599c6e684b76a890881b8d

  • SHA1

    9d5ddcca274874cfed01ac6f3b653055bc1e83f2

  • SHA256

    2eb6c67ed8db5ef15638002b080f42c59e590b77a006e58dc719ae29ca01450f

  • SHA512

    be6220eb5f5483976988925290c6a4e820f890859580a749fa256aa5e65e1628744bff07ffb5fb844d2ddadb36670e7db094c4abe572215d8a59b6b6c5114320

  • SSDEEP

    3072:SixLISiSSb9ioH2JuIDZDQ01g5SwtdmC5Nw79nsB:fxLNfSdHZmYoGQhns

  Score

  10^/10

  smokeloaderupd1backdoordiscoverytrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2