Extracted

• • Target

    d01bc9755704b973d76010375c96d4de026ac25a8ca4ae8792a05733ade07bdb

  • Size

    317KB

  • MD5

    0ef345cb01c76b5c447e54de6cbc8f53

  • SHA1

    82751eec5c8a990d6d4f4de2b1ff0084ab2ef832

  • SHA256

    d01bc9755704b973d76010375c96d4de026ac25a8ca4ae8792a05733ade07bdb

  • SHA512

    12e9f3e7ed50dfe41721bd66ac1fb221715fb1517e6757e272f4a793f8e13569fa7758fb3f736c5002ef0471999d952147e5ce120a07e3fadd17f375f5e8f5f4

  Score

  10^/10

  smokeloaderbackdoorcollectionevasionsuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1