Extracted

• • Target

    5ed271e10ba37319d01d44acd33489a7.exe

  • Size

    284KB

  • MD5

    5ed271e10ba37319d01d44acd33489a7

  • SHA1

    7130a850b50d5fccc1401f57ad95cac863a02062

  • SHA256

    178fb69c394a6d86a3695acbb025bc2f3be31dea683ee6e5016af0566eef8111

  • SHA512

    882d1adf9f2513d5578a72dcc50f0ef510def30c2c1ed0af5f051752e299a72be79c48660038aa852a39007c8286c6ea2ba2886cf0d8e4a859573faedf1ca27f

  Score

  10^/10

  smokeloadervidarbackdoordiscoverypersistencespywarestealertrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2