Extracted

• • Target

    03c212dd83158c5095d3db450555d73966d352190b20f51c6580d1da7961f12c

  • Size

    247KB

  • MD5

    06a4fbd475e2f13d3080d62ce527d5b5

  • SHA1

    6a9cdfae612bdb024e3bf6fe53be57a28029e863

  • SHA256

    03c212dd83158c5095d3db450555d73966d352190b20f51c6580d1da7961f12c

  • SHA512

    5b5b67b2636c515f70a0a147ccbdef48148ec63b5c37a44964db35f0cd29e8564fafcaf5c9a39c7b326a1506e0f491fa39679fb63e6ecf90dfea30a31a170913

  Score

  10^/10

  smokeloaderbackdoorcollectionevasionsuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1