Extracted

Extracted

Extracted

• • Target

    edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e

  • Size

    168KB

  • MD5

    ec093454a010a3e301e6b6e4cb5184cb

  • SHA1

    d9912927633c0d7f95edab4a8cabacccf7ab58d6

  • SHA256

    edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e

  • SHA512

    0fe24aa7fee463d2dc4bbcb628210bbbebc8f09495766a116da7e2ae9622daaa9d6a9a8ac2eda206a378987ec975f7cd87249d376b9775aef7fc820a7a07a027

  • SSDEEP

    3072:42w44jo5hGz+SbvmhBGNm0T3eLQFbAwQeeyGACS:4HLyXG6H0TUGg

  Score

  10^/10

  amadeysmokeloaderpub3backdoorcollectiondiscoveryspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2