Extracted

Extracted

• • Target
    file.exe
  • Size 217KB
  • SHA256 5356dfc8d72b534ffb3897042cccf3d4b30a74fe89252da8f8ac96c7e3593fb0
  • MD5 ae6802727d84ab0192d420a2392d48eb
  • SHA1 f79b9e59deaa9046ae776cfcb3ae18ddd52c1805
  • SHA512 9df9eb0799a6bf2897557b225bef1292bcde64922bc40cced4de1fafc51e14d49e62412b9764e08c88e69f18640783a973d19271c84fb371443cfacecfd19e0e
  • SSDEEP 3072:yXluwL0kqD5yHHqFuJ3uGg0/b8/wA9fnnkFdSBzAnzRj:yowLLqQqFuJ3yT9fnkFdSBEnV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojandanabotnymaimbankerbootkitpersistence

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2