Trojan:Win32/Smokeloader.GNW!MTB (file analysis)

The Trojan:Win32/Smokeloader.GNW!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Smokeloader.GNW!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Saami
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks the CPU name from registry, possibly for anti-virtualization
• Accessed credential storage registry keys
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Smokeloader.GNW!MTB?

File Info:
name: E796799AD940EF1FBF40.mlw
path: /opt/CAPEv2/storage/binaries/3eb441c3e54160c3be16193c0ce7977e08fe2b34aee3d6546648677be80ab4aa
crc32: 82324505
md5: e796799ad940ef1fbf4051b73eb6a335
sha1: 95904478aea5e774d1ab82203a651a07bc685886
sha256: 3eb441c3e54160c3be16193c0ce7977e08fe2b34aee3d6546648677be80ab4aa
sha512: ef7f68bdca446269163727246169c4c2f52f12472bf5d6654d38431e4fb65e1ce7e32a67d86e99a32e43d224c33c5e891f5da828f737d7e96e8dffa7643e53fd
ssdeep: 98304:xStAbmRKZzK9n8rQd6XkNuXlL3AyS/YFxmS1AY7:xIxt1c46L3AywExJ1t7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17F1633112296BAB5E9510AB38E01C67A5A8A7D514FE174CF73E4E29F3C3B5C19C6830F
sha3_384: fd9a34cc03528c538fc004ba768cf747d2a9cd0f1289e64cc138008de41f5761954abbe16068087aead3ad04d0d1b203
ep_bytes: e8d83e0000e989feffffff35dc508100
timestamp: 2022-07-21 12:27:44

Version Info:
FileDescriptions: Buttis
InternalName: FantasticFlow.exe
LegalTrademark1: Pascal
OriginalFilename: Blamer.exe
ProductVersion: 58.38.74.74
Translation: 0x0788 0x04e4

Trojan:Win32/Smokeloader.GNW!MTB also known as:

How to remove Trojan:Win32/Smokeloader.GNW!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.