Extracted

• • Target

    file.exe

  • Size

    186KB

  • MD5

    888dc548217a0fd0cc3c618b7fdeda41

  • SHA1

    7af031a4cd00afd5d22722223a175b371c8e506c

  • SHA256

    8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86

  • SHA512

    4bf7f4e9c5edcb1938d5b297ec6c3b016ed422d6ecaacd2ea7ddf907ad303f2fcf8bd987e0122e89e6974980107fac0a545934a9521fc4450ea5b93697aee82b

  • SSDEEP

    3072:rehYPAOPyHxLZUiWmOGs5BiVBqgQGdzI8UOyelVE6Lx45p0y:ChlLZUiZ3VBqB5626O5N

  Score

  10^/10

  smokeloaderbackdoortrojanamadey

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2