Extracted

• • Target
    file.exe
  • Size 302KB
  • SHA256 a021b1d976afb2651e92e67f7f0af160ada0ba69f1ceeef6df1452d4e6170b4e
  • MD5 7d995b03a3a161525a9ea067304859ff
  • SHA1 ddcd231bfc41a5f062d39e64ff1ba85b833309a2
  • SHA512 62598a525220bc1e7f84a4bfc4198dd750117db3ebdece4ca80301e5464f25c3189821875edfb6881002bf3ef4c7f0370f349d404b7f0923ab626af0cfb3d031
  • SSDEEP 6144:HaQLm4O1pW5t2OXqoCup5FXkFT9UZdLaYon5Jk4eROw1g:6QDOvWf2OXqButoadin5JF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanamadeycollectionspywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2