Extracted

• • Target

    3d3df80f62c7b2ae830dcccf38626443004f61f0c44750cd8e8b3a84b615fc0e

  • Size

    318KB

  • MD5

    392562636ab2d7aafc43c18a7540ef57

  • SHA1

    326d538909ece8442b3c5c73869c24e56e24e181

  • SHA256

    3d3df80f62c7b2ae830dcccf38626443004f61f0c44750cd8e8b3a84b615fc0e

  • SHA512

    e85f5f9c958a4f344cf88dc6fb126474d44381e92b6a0407818af74407e91c3d1ec436f6d8623bde25e1bf6cd62f43674ed48f4c52d9ce99e8abdfa84bcf9419

  Score

  10^/10

  smokeloaderbackdoorcollectionevasionsuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1