Extracted

• • Target

    Order VVNC03023976.xls

  • Size

    999KB

  • MD5

    97b9e5a042f1e7a2bfde4d4fe73c49e4

  • SHA1

    321cbbce23997d77e71cede025c8e30044d82784

  • SHA256

    8a7d1fbcf94d9893fdf8cfc28525dd77c328d4c9e24486b3bed38c12a151f878

  • SHA512

    a1d99e324108403f96fc7e4fe66a751dd40fc2820d5fa2cf4962447dee2513081fc989e8d0f3ab83e901ef04dea642665b5e39e63ad9a958a139bfff0cc2ff3c

  • SSDEEP

    24576:RFeCiaFeYLFRT5AmkmhYnea18TGB1rPXXzXXXXXXXXXUXXXXXXXXXXXXXXXX1J:D91fflYnr18aBIJ

  Score

  10^/10

  purecryptersmokeloaderbackdoordownloaderloadertrojan

  • Detects Smokeloader packer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2