Extracted

Extracted

• • Target
    Payment-244581781.doc
  • Size 221KB
  • SHA256 dc0715adb07b65af47d660aa7582f9ecdfc770606f1a852fe1aa7a643bba7543
  • MD5 5f8bc9b193340a045df1640e77342e3b
  • SHA1 de4e0565d2117a385e4277dcec6a8a53153a20c4
  • SHA512 bd554406c4c694988e51c76410725b63cc61fcb85be306f31028c49d99303e40b2997c2c60b2e428c8fa4c1ebc30c8922ce2949d5961e935683a32b36a1d5b90
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoorspywaretrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • JavaScript code in executable

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2