Extracted

Extracted

Extracted

Extracted

• • Target

    JonnyBoi_SmokeLoader.ps1.ps1

  • Size

    456B

  • MD5

    f44e1099a3ad7de77b06b0884a0195a1

  • SHA1

    32c5bdf2346986abb3afa44c0b259d10b4fa0793

  • SHA256

    06db102d1c5d9386cd8d13e22237b286e4ecf1869c84cc70f17da0d421ccad3d

  • SHA512

    ec60b1401b6f83e05f2b6a377c04f5b53322b78b3482faea8240789dc321b8a4e36ca743a5d0944b15f14eee77d644ce8237332b21836a6ee05d9c1690f7f205

  Score

  10^/10

  redline747nam5discoveryinfostealerspywarestealerraccoonsmokeloaderd020f14a64593b123f5299012b4c811abackdoortrojan

  • Detects Smokeloader packer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3