Extracted

• • Target
    1552dbdb5fcb0236dbc9897df14e98c6.exe
  • Size 136KB
  • SHA256 5dd71da9e576dc4b91f9b9ded0c0b7648604938fb83343063e44b99bc3eb23c6
  • MD5 1552dbdb5fcb0236dbc9897df14e98c6
  • SHA1 c29986b9d0d1c05a721f08a3c259c62814ef8a34
  • SHA512 70fe2fa9000bc8aee8eaca6a1c39cf6131f747a72d3623c077f5b9f24b9354cf3f3431c21bdecc94d0b8962522865a380aa1737a854e61b18957e727da67e980
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoorspywaretrojanupx

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • JavaScript code in executable

  behavioral1behavioral2