Extracted

Extracted

• • Target
    1ca7eb5a765e8ebb1130e1928dfc87de
  • Size 57KB
  • SHA256 bcca18fef46e71ff82ff342dbd50f09b9ea768edc5e328fbf85241fcf615507d
  • MD5 1ca7eb5a765e8ebb1130e1928dfc87de
  • SHA1 fa73a09f553f3d16b9494e0fa2a20eba1321e4b2
  • SHA512 1f2338e21a359fd5a0cb771b443f5b4f263b5333534060d971b4876b647b8624b952210d8de305151e544e952d32b37147350dddc154a1cc2b4909e0e5cff533
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinesmokeloader7backdoordiscoveryinfostealerpersistencespywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2