Extracted

Extracted

• • Target

    NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe

  • Size

    363KB

  • MD5

    dccb60fb185d8098f3844b5d5777a045

  • SHA1

    2b8e3b905310d713a443b844e110dbb71359b09c

  • SHA256

    dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4

  • SHA512

    edb8ee6fda1764a2958e9b932828e579c2408cdd29919331f461a02107d01be48d3e03f51329410630c614d933302b4df380efe38616cdaa7754cd267d566639

  • SSDEEP

    3072:wwH52YRs4UEbwIeG+p1C3nIsP3ozz6rRZ+pr4/lGW/o2xNbr7ZwVRU/qIUgd1Uvc:tEYC4UmwIeG/I+3Ks/UC7ZwV8Pyo

  Score

  10^/10

  smokeloader0024backdoortrojancollectionevasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2