Extracted

• • Target

    04psi.exe

  • Size

    237KB

  • MD5

    4bc2708122b1e43131888d1beee6c560

  • SHA1

    8a82caf8b8f908898145e953ef8f1e665e8058db

  • SHA256

    3fc06d1926ada759903e4ebc197f9da5baa80fb8f729f34395dd7c67e2d58a8c

  • SHA512

    fcf714de9ae1d23ebe054f601938653f9643dbbf288319b4c3b2872544dbb2c82c5db8a4abc64a146648da9f5b71760ce485c1b5935473d214736438dffc2749

  Score

  10^/10

  smokeloaderbackdoortrojanredlineinfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • JavaScript code in executable

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2