Extracted

• • Target
    ab606f1f97bbc65edd55952a2daf2252.exe
  • Size 213KB
  • SHA256 2123f46b435c2e8765a882624a35060d86226424c97a2b2a9edad4b75bd0ba3f
  • MD5 ab606f1f97bbc65edd55952a2daf2252
  • SHA1 1ec0354c1f2a2ef61f3193511ea172f947734b13
  • SHA512 483f86ad28e5c61a52eb8d874d82fbe559f3386b189b5e856fd5fabf9ad3fa604790828164e4e6249462fefb7183ee1f9f4a3ab93166501f29e740510eaafdac
  • SSDEEP 6144:Tv2LdFDqNR8H1N108GtQlOM0d80N6tzOZ:Tv2BFDqNRMN108iQlOxN6ROZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanerbiumspywarestealer

  • Detects Smokeloader packer

  • Erbium

    Erbium is an infostealer written in C++ and first seen in July 2022.

    stealererbium

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2