Extracted

• • Target

    7910bb1786288ed1cc204913f0785c32a1bd0b1ee3476d2ef260df564be3b2a5.hta

  • Size

    131KB

  • MD5

    63c86bc9c616e32406ec965054e9d4b0

  • SHA1

    d1a0215e7fa42f4a994228d9cf86ac0a9e3ccebe

  • SHA256

    7910bb1786288ed1cc204913f0785c32a1bd0b1ee3476d2ef260df564be3b2a5

  • SHA512

    15109c6afb31ea10c80b8d3b02eede606d3b2f7f50f55046431b526ec52a9ee0a9ef0328a72dad288e6d11dd5eb2b21f43ecc83a999d03b2886c5926a7606d01

  • SSDEEP

    96:Eam7Xy1+49+cxfj3+dn8HQKozLnm+/07T:Ea2Xy1l9qdQQ7LnmIaT

  Score

  10^/10

  defense_evasiondiscoveryexecutionsmokeloaderbackdoortrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2