Extracted

• • Target

    ee1f203a8db154c323fc1d72950a1ad367a94ca45da2ba726cbcb8708ab12cd2

  • Size

    241KB

  • MD5

    cffd474ad7818304eb575dae2b0c52b1

  • SHA1

    b27607d79eed909c629cc78e0fbd1bb830470db7

  • SHA256

    ee1f203a8db154c323fc1d72950a1ad367a94ca45da2ba726cbcb8708ab12cd2

  • SHA512

    1f9d7d934c81c902b19c877c150e1c44ce1db8b777b3bfd5099c20fca8c73a4861a98a2648751bbd9e6e0643218aad256b760555e559897ab2adcd26a6777975

  Score

  10^/10

  smokeloaderbackdoorcollectionevasionsuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1