Extracted

Extracted

Extracted

• • Target
    1a1dfe0fb4917f9f6c0585af695ffc45.exe
  • Size 244KB
  • SHA256 ff0500a380008b913b550a84c7ddcc17f4a8c07b6778f24e7dc333988b1fe336
  • MD5 1a1dfe0fb4917f9f6c0585af695ffc45
  • SHA1 9cfbb619dc98498f9791cf8b759bd1fca6983243
  • SHA512 0d9d6f4a7f2ea94a4877cf51a35b86141ff9e2ffd855986de097200f1f6bac1fef641275932cd1ea759fc555343ae94d8582cad237b02956758bc2338457e64e
  • SSDEEP 3072:/wZm1wLxrRmddvRLByDde2D0IifymfM3Md6kbYZQTdNRunrcSO4Dtl16/AaqP:Am1widpLByDdPD0lBfMfZjrNh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeysmokeloaderpub1backdoorspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2