Extracted

• • Target

    ab606f1f97bbc65edd55952a2daf2252.exe

  • Size

    213KB

  • MD5

    ab606f1f97bbc65edd55952a2daf2252

  • SHA1

    1ec0354c1f2a2ef61f3193511ea172f947734b13

  • SHA256

    2123f46b435c2e8765a882624a35060d86226424c97a2b2a9edad4b75bd0ba3f

  • SHA512

    483f86ad28e5c61a52eb8d874d82fbe559f3386b189b5e856fd5fabf9ad3fa604790828164e4e6249462fefb7183ee1f9f4a3ab93166501f29e740510eaafdac

  • SSDEEP

    6144:Tv2LdFDqNR8H1N108GtQlOM0d80N6tzOZ:Tv2BFDqNRMN108iQlOxN6ROZ

  Score

  10^/10

  smokeloaderbackdoortrojanerbiumspywarestealer

  • Detects Smokeloader packer

  • Erbium

    Erbium is an infostealer written in C++ and first seen in July 2022.

    stealererbium

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2