Extracted

Extracted

• • Target

    4001ef3d5abca387a707411e1b11c07ed5b0bab60d5409831f55dcbdeb86a60f.exe

  • Size

    276KB

  • MD5

    324f47a307e160a75080e4d7f8175fb7

  • SHA1

    7a14bb0ff3cfdd94316f3e650ba7f3b73fdd6b0d

  • SHA256

    4001ef3d5abca387a707411e1b11c07ed5b0bab60d5409831f55dcbdeb86a60f

  • SHA512

    b86312b91c0804e62e9cbf332eff0d8a5719ae9a723f4dc545237a43b00cad888867fba246fa03e5388a5f67f280f50265e9e24df8ffb67fa66076e599db1e99

  Score

  10^/10

  redlinesmokeloader@soul3ssbackdoorinfostealerspywarestealertrojanupxdiscovery

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2