Extracted

Extracted

• • Target
    file.exe
  • Size 229KB
  • SHA256 81dc065d9bbbe3ff88d7d667c933fa4f6f2926f80b279d9d7c0c3b6eec8ba98c
  • MD5 7ad6507a7b2d29a69212af37f0384968
  • SHA1 4b626356da19c2b8d9fb7aceb168c276001e9c33
  • SHA512 ab9ceefcbc4530603dd48558dbe1c2bb17c5c22812582a93b4e5c14b786ec5b0cb8f0ed466f4c20624a9cad0dfc5cb38d4938f3e07414641067b8bde734f739f
  • SSDEEP 3072:Fvnoyp4ffH/hLD1Kdhly6vBeAcmuf9czAAFs45MIAkw+Zsl:FvLQJLD14hkeqKzAAFs2Mdk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojandanabotnymaimbankerbootkitpersistenceupx

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2