Trojan:Win32/SmokeLoader!pz (file analysis)

The Trojan:Win32/SmokeLoader!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/SmokeLoader!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Punjabi
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Checks the presence of disk drives in the registry, possibly for anti-virtualization
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/SmokeLoader!pz?

File Info:
name: CFED5701D23DF529124F.mlw
path: /opt/CAPEv2/storage/binaries/f41561a76c0432e967cd6847fccd29834474e86f64e710a850aaa5e1e10facf1
crc32: 15753591
md5: cfed5701d23df529124f0ddec61320e0
sha1: 6eeb4c47a33a7a6e767fd83c705c15ebccb357d3
sha256: f41561a76c0432e967cd6847fccd29834474e86f64e710a850aaa5e1e10facf1
sha512: badc2b42b5141b998a92232046a203ec334639048a372f5ac9f39c4f6623e7b71ea7f1e53ba62de29d643c99f5e66543f657a114be4bf96a64293bc86c4de3a8
ssdeep: 3072:SsQGx9OT1YvHShbQbTTkw9yFT5a07N5d+nSQ5LleQ:aGfOZCS5QbTTv9yFT5a07dcz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A054E643A2E13D44EA268B729F3FD2EC771DF6918E497B6D22189E1F04B11B2E163714
sha3_384: 861562963e845197469e6014f0fcea9b9d02af31cfe506311a1b70793c35563270e5428c40f015b7085aa4a3f3026ef8
ep_bytes: e8701a0000e978feffff8bff558bec8b
timestamp: 2022-11-03 20:03:15

Version Info:
FileDescription: Malling
LegalCopyright: Copyright (C) 2022, Crazy
OriginalFilename: Jungle
ProductsVersion: 57.5.29.90
ProductionVersion: 47.50.29.96
Translation: 0x25ac 0x0e92

Trojan:Win32/SmokeLoader!pz also known as:

How to remove Trojan:Win32/SmokeLoader!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.