Extracted

• • Target

    a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21

  • Size

    333KB

  • MD5

    1e320b4f6676b09a3886632b653edd3f

  • SHA1

    1c3174d4f9df6049491da0a0ec2525688e3cc850

  • SHA256

    a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21

  • SHA512

    97381e742d0e10cabeedf606a49b170a8d720fa66856b5a2d02bbe888b28f5d88b899f9b14e1c63f3c2d92e2663b72a30ad8c8a7e51871406bb982a77c981a3c

  Score

  10^/10

  smokeloaderbackdoorcollectionevasionsuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1