Kuirmfggi Trojan SmokeLoader Analysis

Trojan SmokeLoader

Updated on 2023-09-21 (12 months ago)

Online Virus Checker	v.1.0.139.174
DB Version:	2023-09-21 18:02:47

Trojan.Win32.SmokeLoader.bot

SmokeLoader primarily serves as a malware delivery mechanism, dropping other, more destructive malware onto infected machines. Its stealthy infiltration methods and complex obfuscation techniques make it challenging to detect. What sets SmokeLoader apart is its extensibility through plugins. Cybercriminals can add malicious info-stealing functions to the loader, making it a versatile tool for data theft and system compromise.

File	Kuirmfggi
Checked	2023-09-21 15:48:16
MD5	a16deca45bc533df1e829b786b12c8df
SHA1	2be747eff9effbf696e17e109b1f03567464b4b0
SHA256	980a736f3c959e814619ab185cf89fd17a930774f11aa06ca79e263be6d077c9
SHA512	b1a021682fbf1446e7a1207478ebeb65803fd088c3c448d29ae30fa0732d8b20b1fe0d383443faa62e20ccec1456511018c3965dd12e399018664989c09e31d7
Imphash	d13f0a4e1c3acd1a644a413a45b35009
File Size	212992 bytes

Trojan.Win32.SmokeLoader.bot Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.SmokeLoader.bot without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

FileDescription	Imbacubus
LegalCopyright	Copyright (C) 2022, Unihumus
ProductsVersion	29.510.12.16
ProductName	Kuirmfggi
ProductionVersion	153.24.90.66.7
Translation	0x25c0 0x0ad4

Portable Executable Info

	5cf72abc734b99aa50645dbf7cf1ae01 b0265aacecb301df21ad44c53887eaf7 bce9f6f2e0c4ebf4
Image Base:	0x00400000
Entry Point:	0x004056e1
Compilation:	2022-05-28 17:09:30
Checksum:	0x00040d37 (Actual: 0x00040d37)
OS Version:	5.0
PDB Path:	C:\yiravug\bizawavu-zemajujota-38\s.pdb
PEiD:	PE32 executable (GUI) Intel 80386, for MS Windows
Sign:	The PE file does not contain a certificate table.
Sections:	4
Imports:	KERNEL32, USER32, ADVAPI32,
Exports:	0
Resources:	18

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00001000	0x00027c34	0x00027e00	f39056bdcbd4f42e1f31c0bcd12f6a13	7.56
.data	0x00029000	0x00113428	0x00002e00	9dd79045a79e302dc9add19691cb3808	1.82
.rsrc	0x0013d000	0x00006b80	0x00006c00	eaebd8bc03aca24115b3acbd93d689ad	4.24
.reloc	0x00144000	0x00002376	0x00002400	392ae052fdcf5003e7b4558280f13d9f	3.17