Extracted

Extracted

Extracted

• • Target
    b2746a96337f79494d3bfd452c5fe1f069b45b9f008a680f868e5a79021c37c6
  • Size 240KB
  • SHA256 b2746a96337f79494d3bfd452c5fe1f069b45b9f008a680f868e5a79021c37c6
  • MD5 32a338d19e0ae30d5f03936bbd64a997
  • SHA1 d74f6a5673fc0ae1e61042c7d6ba1d2907bc062f
  • SHA512 1203ed34a31679aecd07e4ca091ee484caf919a84a0c8a31fa81b5f51df54718162ec8bb81bb5f05288b60f426f8e13a6efc596f40bf1f44bd147fe334975ce5
  • SSDEEP 3072:K0WtGRxpvxGVgyAtgKro3rNebFjli/YcEokXEWrMvvxJQUTjJ6WLBGWU54yJp8bt:KRtOvcVgyyWkb5cEQZvIIJBTyr8c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeysmokeloaderpub3backdoorspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2