Extracted

• • Target

    f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af

  • Size

    333KB

  • MD5

    64fd1b8745308047478159df6b39bbb7

  • SHA1

    1a711ed0e2877482db4d08fe1e11e366b844d20b

  • SHA256

    f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af

  • SHA512

    8b8ae98392ae8b97984c02bfa00473e448e77a6a88108bff6be193eab26a81cb8b801e3b4d8ff3d162036d25b398269b9205e1317314514e5b0718986355482d

  Score

  10^/10

  smokeloaderbackdoorcollectionevasionsuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1