Extracted

Extracted

• • Target

    d404080222d2281802982fe927416290_JaffaCakes118

  • Size

    180KB

  • MD5

    d404080222d2281802982fe927416290

  • SHA1

    c0c6466fee1840922ae1df603c1b38d36841f1e8

  • SHA256

    9d9b3d076bcc00d240abe7a49a1cc9180d670b6b5e1c9e4bbeba38be2c0acc37

  • SHA512

    587d7a5e949414d5d79137076369218a4fc59036ef0990179d12c9b4e46752eb9a4cfc645ffd258392781c071c1f3e45391588dd947e816562031f53b57adffe

  • SSDEEP

    3072:R4vhjxMapBECJj+iqM8dTxoze71zPjVPd4ySKeXLLrrMuZw7k/M9S:R4vhjxMapBHjvl2Txoze71zPjVPd4y1p

  Score

  10^/10

  smokeloadervgubackdoordiscoverytrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2