Extracted

Extracted

• • Target
    _fbb697f6ff25ac3ea01c7536945ec053406f2fdd30e802350a2c28fcb19672dd.exe
  • Size 46KB
  • SHA256 fbb697f6ff25ac3ea01c7536945ec053406f2fdd30e802350a2c28fcb19672dd
  • MD5 8be3cd07b71a42de138232531975935f
  • SHA1 9d42bfd6862989d796ceb7512ef33bebe6706fba
  • SHA512 bc302865e4c0eed55d646a03c3605efe11e072df921b514d6f8d2c40a2ef845f73b2be9f3e93235ffbe6c73dc08e132e736864d2430897097a2709fa394d7e48
  • SSDEEP 768:+gh9gGYnm/nob3PEAr3LLM+Ri9tHnRmlxZ94LDfOjSfd/euxhVcRCjdXOmOpRB9U:+ghFmHzjr3LVND86SfUGbcRCO9xR9
  • TLSH
    T1CB23024A148E8444EC60B77482F527647F2A1E336CEC3F56750728DF7EC5AF035A88AA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcollectiondiscoveryamadeysmokeloadermacropersistencespywaretrojanxlm

  • Detects Amadey x86-bit Payload

  • Detects Smokeloader version 2025 payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Suspicious Office macro

    Office document equipped with 4.0 macros.

    macroxlm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2