Extracted

Extracted

Extracted

Extracted

• • Target

    b8225a62668d356813e324e2debdd1659923cce58060bd50114359cb39ceb5e1

  • Size

    534KB

  • MD5

    fcf52756a313398b5210f062ac0ea368

  • SHA1

    349ae6351c7d51a0be25b3921354cd77b1a49672

  • SHA256

    b8225a62668d356813e324e2debdd1659923cce58060bd50114359cb39ceb5e1

  • SHA512

    ef478f39793e8bab7ef47cd00a024028658311f3f453a50cf6eaa23bdf99b3169187c9da15812b9372d6ac064f8c50823f71242376c02b37b982704dfe1ae3c1

  • SSDEEP

    6144:j+AUxvdjNgBoHFIZ0YesFZITJuUQnggq3KEe9fV:vQNg2FTJuUQnggq33IV

  Score

  10^/10

  fabookiegluptebasmokeloaderup3backdoordiscoverydropperloaderspywarestealertrojan

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1