Extracted

Extracted

Extracted

• • Target
    704cc92bd17776d68f70d51ed4e9caf7.exe
  • Size 244KB
  • SHA256 d8a85eb69da59b65f537a2467f32089f08c527a73b2abf8dbc7d315f85a651e9
  • MD5 704cc92bd17776d68f70d51ed4e9caf7
  • SHA1 50d567f29b4bcf3d3fe00ee2e25e6d5ca2ad664e
  • SHA512 f5974fd67b9db2268d7630f9b605986e85ab5e767a06655350208b55147101f429abf0ff332c9834c514e5d1b7b9a04b37e057df540a2e63ccefcd0da790ccf0
  • SSDEEP 3072:6wZm1wLxrRmsKod3soX0KS3AqqveewbfM3Md6kb5BTdNRunrcSO4Dtl16/AaqP:nm1wu03YKAAqBbfM+SrNh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeysmokeloaderpub3backdoortrojanspywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2