Extracted

• • Target

    c3147cf991ebba6e208526f0a2b88356d0da4702b6040a26ddbadc911a776c9bN.exe

  • Size

    294KB

  • MD5

    2969fc1afb91862747e6871785560260

  • SHA1

    fefc6c855ed6f24267e0b3eb708842330401c1e9

  • SHA256

    c3147cf991ebba6e208526f0a2b88356d0da4702b6040a26ddbadc911a776c9b

  • SHA512

    521bd215ff26ca657cbde0470bee6fd36695a10570c1fc915c36a433336a6f6551238b8ee61ad19273dfee81c6f7bfcbb44d31a4d6d26aaf43e37ace7a66cb9b

  • SSDEEP

    3072:eTEf0l0OMJisuULt02JdZ599LbayiV1FEGzZsSDSIqh3yLSUEdmBHjBz9:t0lquULLl6VEpuSIqhcSUEo9Bz9

  Score

  10^/10

  smokeloadergoodbackdoordiscoverytrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2