Extracted

Extracted

Extracted

• • Target

    345eaa8379ef8daed16ebc210e7c0165.exe

  • Size

    319KB

  • MD5

    345eaa8379ef8daed16ebc210e7c0165

  • SHA1

    c9278fe7bf96f97556527782f271a554a8b73a68

  • SHA256

    88e66423a3a96f03441102060b775e35d0e401a3e4f74e1c3e54f9bfdcd06258

  • SHA512

    1a094d8070c0243fcbdef5ff8361192ae7e98f396072f28105b70680b2b7386d3afad64f8f784d5d5e1d54f690b0cb2871e0929c1aad0ad64c543d68dc2b0b5b

  Score

  10^/10

  redlinesmokeloaderbackdoorinfostealertrojansystembcdiscoveryspywarestealersuricata

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2