Extracted

• • Target
    9af40d7dbe70e708bc2fc5cdf500f7f5389210ed8813f006ac342d6983dcd2ac.hta
  • Size 206KB
  • SHA256 9af40d7dbe70e708bc2fc5cdf500f7f5389210ed8813f006ac342d6983dcd2ac
  • MD5 1d7fd9405d04f45b7623ceea3602ac1a
  • SHA1 20d6bad0c83ace824ca2c962b9a16f6b2ff0afbb
  • SHA512 c5ef145291e6a971497ccc1225b7ad369ea798164acdfdd03a1760cd5c435868feef43727df870cf3cb8e7d40c1046f7ae6aad0a825328148553aaa517936161
  • SSDEEP 48:4FhWsTR/F7gNqXfjH3BrGi3JX3Brmi3Jl7uW2ZxzBKI72VVVrsBAte0oNz3Brs3K:43F97ftlvFHGxtl2VfrJ4a+pM/Q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryexecutionsmokeloaderbackdoortrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2