Extracted

Extracted

Extracted

• • Target
    4b06c62c07429d0bbc7f9126a18c2e959e5c52c09236dbfb5b16a09390f0a300.exe
  • Size 288KB
  • SHA256 4b06c62c07429d0bbc7f9126a18c2e959e5c52c09236dbfb5b16a09390f0a300
  • MD5 e88da5d3f528d78eabc2de83797c2195
  • SHA1 7937c0b3fac48fa50aa74e80387a6ff6f463c978
  • SHA512 4dfb673cfab033d7d40ef383ef36841d3c8fd1a1f2c80bfd05c896aa3d9c38c08301d89e4543e9b300a44787c9a57a13e34654f5374d6788c1e56e37c69be9a9
  • SSDEEP 3072:OziRfFi3WzI2OfoyFIUVvBmAx0H3q0eJ5cLw5p0s0hQUxaIa2VM:/RfFDG3FJVvtyeJ5JKQUxaIh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeysmokeloaderpub3backdoorspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2