Extracted

• • Target
    581a84b899a7e45579283fbdfa321d73.exe
  • Size 410KB
  • SHA256 6e23c1316c64fd1f4cb9d56f64adcdc29f18705a1c26c42e90cbdafa5cc731dc
  • MD5 581a84b899a7e45579283fbdfa321d73
  • SHA1 daa65d31c6032603048a7e1c5a00290e6e3e4779
  • SHA512 53e286189a5fd6d33728f6a94dd31f896c4c439e5e48c8bbdb0399827ec82614c4678fdfdd1a36874bb6b6ce369517edde0b1dfd02650646d7852f09dafff3e7
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoortrojanevasionsuricata

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    suricata

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion
  behavioral1behavioral2