Extracted

Extracted

Extracted

Extracted

• • Target
    file.exe
  • Size 301KB
  • SHA256 534c070e0b4adbbade28afbb222f297d1c291d635a46ba9a7f3da239b81f8ec9
  • MD5 b8c134669170177b1b12083761ec563d
  • SHA1 1069a38af8da3f75d88e739ead00c4cc073d4668
  • SHA512 e41e63b435de6134ac2336b6162d30d809d4252ebde07befc83c33a436200c0fa4c76dc2a81813dbf3e76f9db262ff42213e2ea89a6cb698e98bd3559f5d649d
  • SSDEEP 6144:CasLtT+bqUZzKTqXI+9UZdLaYon5Jk4eROw1g:nsx4NKDpdin5JF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanamadeygozi22500bankercollectionisfbspywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Detects Smokeloader packer

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2