M24e002m.exe Trojan SmokeLoader Analysis

Trojan SmokeLoader

Updated on 2024-02-05 (9 months ago)

Online Virus Checker	v.1.0.158.174
DB Version:	2024-02-05 09:00:29

Trojan.Win32.SmokeLoader.bot

SmokeLoader primarily serves as a malware delivery mechanism, dropping other, more destructive malware onto infected machines. Its stealthy infiltration methods and complex obfuscation techniques make it challenging to detect. What sets SmokeLoader apart is its extensibility through plugins. Cybercriminals can add malicious info-stealing functions to the loader, making it a versatile tool for data theft and system compromise.

File	m24e002m.exe
Checked	2024-02-05 07:35:30
MD5	e3dc222d0a34c4b230f538a67bb7265d
SHA1	d88345aef0e59341e6c4297d2685cb5f08c0aa80
SHA256	a7f605d4110bba430e02c7c5240e656fb3f1dd7f02dce985e9e5677169c9de55
SHA512	3d775c3c940ddd3d43fa56726ae4f8c0442a4d576cb410e60e2f010e1ff6273a2064f646c6af4a6993ff78924c329ac821811f97402d1472495c1d7a6d838797
Imphash	f34d5f2d4577ed6d9ceec516c1f5a744
File Size	290816 bytes

Trojan.Win32.SmokeLoader.bot Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.SmokeLoader.bot without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription
FileVersion	1.0.0.0
InternalName	Eflbu.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Eflbu.exe
ProductName
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Portable Executable Info

Image Base:	0x00400000
Entry Point:	0x004484b2
Compilation:	2023-11-04 21:31:13
Checksum:	0x00000000 (Actual: 0x000486f5)
OS Version:	4.0
PEiD:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Sign:	The PE file does not contain a certificate table.
Sections:	3
Imports:	mscoree,
Exports:	0
Resources:	2

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00002000	0x000464c8	0x00046600	96e1d8d930989662a404d1d0310d7a88	7.99
.rsrc	0x0004a000	0x00000556	0x00000600	1df9c1827f9f4481e50ee96ccca7ec2e	3.91
.reloc	0x0004c000	0x0000000c	0x00000200	b16dcf7bbff13986ebffcf0560d90eed	0.10