Extracted

• • Target
    1a78aaf6aae3b9d9a32dc6c8cfe9182043f71a3d44e727464ab95a70fc24bbe8.exe
  • Size 340KB
  • SHA256 1a78aaf6aae3b9d9a32dc6c8cfe9182043f71a3d44e727464ab95a70fc24bbe8
  • MD5 0a7ab9da9997bf3f75ec4549a9b9daf0
  • SHA1 d5ffba8afc0cccf2a3194c572db74605dd8879d3
  • SHA512 3f03bd23458e05469df1623e55a71b6bdad1c7a9af2bf8e7f8750406bd17e759d8b1049ed1531aeee9da503fa86d692bc29ec1a94126be6ff20b647e2840ffbe
  • SSDEEP 3072:/zWwX4nezRV34wEX7ro/iqicrVgxmumkj9gMGXE1Whx4OmTW:innerrEnCVgJmkjWh0YqT
  • TLSH
    T12574CF327681C032D56A82B444A1D7B54A6FBC710B259ACB3FD8167F5F363E28E36346
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverysmokeloaderpersistencetrojanadwareransomwarespyware

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2