Extracted

Extracted

• • Target
    SecuriteInfo.com.Troj.Kryptik-TR.30930.16772
  • Size 321KB
  • SHA256 c129ece5ce4cc5bc3c8d93ba6801c79e644bf838f4adb262bf7780476576bde1
  • MD5 bc004ebe4199980b8686dc9202f3b7cb
  • SHA1 1645ec7f063632197d0db8662152d62d021e97c2
  • SHA512 edd1ea2a53a4a07bd5c2b9aeb5eff1f8ace56f1c2c7fe407182f4222a2266eeba06f64a0bc01d53f67571512c456da709f223bd8bef1d7669c74656a7426563a
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonredlinesmokeloader50f8ded12c46443e43915127b1219ac2fc439bb6backdoordiscoveryinfostealerspywarestealertrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2