Extracted

Extracted

Extracted

• • Target

    5ee310ba8a5457718b5c554943914d39d820abf6af3ce7ca087d3441ee089662

  • Size

    341KB

  • MD5

    a81072e83ab01de6da91b58215ce1a43

  • SHA1

    9f0fffe9e612c2f1f0e7686d323975e607174ad2

  • SHA256

    5ee310ba8a5457718b5c554943914d39d820abf6af3ce7ca087d3441ee089662

  • SHA512

    e7ca22f0864ed2828b41a9fab6e4e3440ebbe6ce49c9abef46288f2513c5e9cebf168b1e53a748ef0b714370c7142b0eb3e2a5f1b9fe8f593a08946a306414a4

  Score

  10^/10

  redlinesmokeloadersystembcbackdoordiscoveryinfostealerspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1