Extracted

Extracted

• • Target

    61eb677544345506832a856f2e36dd5a50428e7242f9a0a92b87a5b76b374ffd

  • Size

    222KB

  • MD5

    26c7d0f64ba1fdcce1ed66eb7bc8d7bb

  • SHA1

    9202b3e253a4383800b0a7f6d6a58c7f04dcc71f

  • SHA256

    61eb677544345506832a856f2e36dd5a50428e7242f9a0a92b87a5b76b374ffd

  • SHA512

    b3cb50a04e7c1b54e57f73b5e8815b69f0e68683964f81fb72ee3ced010540e54347472e5f5cdc979045d36c264cf7dacd44db74b3cc79f0c1be947a8ad6b781

  • SSDEEP

    3072:QAuikDKOLhvnnsZ4L0FAb/REb/FkXb36dYC64IdkCeD5WSehTo2:NkOOL5nnsuL0FAbuBkXb3gV6BvSehTx

  Score

  10^/10

  smokeloader0023backdoorcollectionevasionspywarestealertrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1