General
-
Target
4496-610-0x00000000007E0000-0x0000000000F72000-memory.dmp
-
Size
7.6MB
-
MD5
a7b29ba9b83f7f7753956beda95fe6f8
-
SHA1
07a0db1f60bfbe64c22314df562610aeb9d9268d
-
SHA256
6fd646f1f8431837481be3b6cbecc73d34eff26be955f681b3039919b995a8af
-
SHA512
75f9ace0c7d601ec8771dc801941664e14ffbddc3cb1df1ec38e7a910c57fe3d4e4f44265c8ad54cf7ae8e5ca33c3819fc772a8d90deedd605788c4817d09565
-
SSDEEP
49152:iAAVUWvSjuFO0UdZj38Q+hKRbC0z1wffY+FPKZqNutOGDVlr3UCU:eWb0wV5HIQ+FSqyOwVG
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2022
rc4.i32
rc4.i32
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule sample disable_win_def -
Smokeloader family
Files
-
4496-610-0x00000000007E0000-0x0000000000F72000-memory.dmp