Superior.exe Trojan SmokeLoader Analysis

Trojan SmokeLoader

Updated on 2023-09-15 (1 year ago)

Online Virus Checker	v.1.0.139.174
DB Version:	2023-09-15 12:03:27

Trojan.Win32.SmokeLoader.bot

SmokeLoader primarily serves as a malware delivery mechanism, dropping other, more destructive malware onto infected machines. Its stealthy infiltration methods and complex obfuscation techniques make it challenging to detect. What sets SmokeLoader apart is its extensibility through plugins. Cybercriminals can add malicious info-stealing functions to the loader, making it a versatile tool for data theft and system compromise.

File	Superior.exe
Checked	2023-09-15 09:18:25
MD5	062665ad0f9f5754137d041d06792928
SHA1	79719cc20f56b9c22b2a38fb0bfdec22a4767697
SHA256	109d9077e847550b471e717986dec00400d4a49cccf438a462ec9630eda654c5
SHA512	16b9d8f1b82b2fd4c7345205760f9fe6edd1cce6e8177ff11c70b5f8ff5eb49c3c4d5b5665de9a759af003bec424a2ea7342462bf4a1ad71b66c1fedf0094393
Imphash	003e055d96712e6da1d64b80d06eb6ae
File Size	380416 bytes

Trojan.Win32.SmokeLoader.bot Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.SmokeLoader.bot without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

CompanyName	Thunderstuck
FileDescriptions	Anybodies
FileVersions	42.51.49
InternalName	Superior.exe
LegalCopyrights	Challangers bottle
ProductName	Bonni
ProductVersion	57.5.64.0
Translation	0x124e 0x043a

Portable Executable Info

	f760d1ace6d58510b7b60291ee46cab5 b3e530ef38ebfe6a001bce898d72752a 8864e1d0c6e72184
Image Base:	0x00400000
Entry Point:	0x004070aa
Compilation:	2022-07-20 11:28:49
Checksum:	0x0005dc36 (Actual: 0x0005dc36)
OS Version:	5.1
PEiD:	PE32 executable (GUI) Intel 80386, for MS Windows
Sign:	The PE file does not contain a certificate table.
Sections:	3
Imports:	KERNEL32, USER32, GDI32, ADVAPI32,
Exports:	0
Resources:	39

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00001000	0x000204ca	0x00020600	d4a8c4d450b0f0364fe1459323b22bb0	5.10
.data	0x00022000	0x01e6b9cc	0x00027e00	1e2246393a33c1ebe9c58d469b11384c	7.66
.rsrc	0x01e8e000	0x000144f0	0x00014600	3e63328024e49b9c1e20cba26381362a	3.73