Extracted

Extracted

Extracted

• • Target

    9a31e105688533003e4bc86ef9497529e22fb021c86d6431cd33189a31f3864f

  • Size

    12.0MB

  • MD5

    e4248e8371d3f34a0d53ebe9e3ce22fd

  • SHA1

    15c0eb4ff3fcc1a39d4be7c0ed930fd92db6eb95

  • SHA256

    9a31e105688533003e4bc86ef9497529e22fb021c86d6431cd33189a31f3864f

  • SHA512

    270cf9c5763bb24a5a9f1b36e03fba05e20a8d73dab4326bffe139b4059d26dac0f70e59b9d18544d56d50632ff993f293b26811f4e7329bcf2c0c62c6d3ff57

  • SSDEEP

    196608:C+YE1ECkrFkMDGn2icn/V2LyjAnY7hdJ5G4tJW6BTlPwSH6TwEob0TV:C3ZeP2B/p8nYZtpFlPPaTxob

  Score

  10^/10

  fabookiegluptebasmokeloaderup3backdoordiscoverydropperevasionloaderspywarestealertrojan

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2