Extracted

• • Target

    28194aab838d42d44d039b2532c6af754db65d25453d583d491d785245589259

  • Size

    303KB

  • MD5

    fd5756155b06ca69cc499ec9d6e695b1

  • SHA1

    bb072ae8b2acc490e4edaf1ddf9c517b9ad868d5

  • SHA256

    28194aab838d42d44d039b2532c6af754db65d25453d583d491d785245589259

  • SHA512

    4c8f54f1f2624323968a793c3861e6f4f1ee96bee4f695a2f3c4191ecc30e2b8494ef4d7d81eed08f89d7b59dea8b514ab32475cfea56ee1441545c522a78021

  • SSDEEP

    6144:JFV2Vqke3XQE9ux+LWFvviu22tThsIeGjY6:gk70+k3l22ZVE

  Score

  10^/10

  smokeloaderbackdoortrojanamadeyspywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2