Extracted

• • Target
    hi/Smoke Loader Original Stub/Smoke Loader Original Stub/smokeloader.exe
  • Size 13KB
  • SHA256 5eb4e7d954ad12e89c9c500f9894b76d08b7e53eb0f3f0b0e681d3bf11c4db51
  • MD5 75f6bb5d297c4ffbdff65cc5bbbdfb37
  • SHA1 0aa7c2e75f63c685d8d085fbafca3a91d297b683
  • SHA512 fdb38133304714e3e553b02df7a7bb62b9127c9c832390ffb1553f3523cdffd00611b29a4916f00bd6b79209fef5b0ca4e4c28192e5522880bbde231c00ca7df
  • SSDEEP 192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4OtgO:JAnLAXNy/m3/bTKgO
  • TLSH
    T1F652BF955B418C1BCB7EFBB9E978CE35D169AE4D27C2C2629F07C82524910B4864BB43
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverysmokeloadertrojanadwarepersistencespyware

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2
• • Target
    hi/Smoke Loader Stub Changer.exe
  • Size 640KB
  • SHA256 ad474568f3157b17e11990d76d521d5aa26f01f3617bc15dfa7f473d19c7e70b
  • MD5 7b8b400d73b63f1668ab90ad62dcb415
  • SHA1 5a4a00197c799850ca0bca9ab71bfb552b1eb21c
  • SHA512 ec565d4f3cb7c72370c92787cbfe0046a4bbb2d73cff8a0a4ccf8c34ea6d31c77a5b10901c70e69f667a4a15d0a987cb6a5fd5e85ba470c8fcba8878556043de
  • SSDEEP 12288:URp3CuOl0PAh879TL4kmVViD65Eeg7cGNMWluaWv2cLNiDSnMFUhXztVHK:sCePQ879jmVViDeDoM8ov2cL4DSndtz2
  • TLSH
    T110D423CD43B190C2DCE73232097283C02B458DECB8AE1FDB9A5BB50957F285A6569F52
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  discoveryupxdefense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4