Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    290KB

  • MD5

    60e040fb9d158f64855ada283f365993

  • SHA1

    359544fbbea7e11c5fc87e98aa7a1c4a280d75bb

  • SHA256

    278112b324b4baf0de15924dd94225df2579d2e5e23a16a270c11e55e5f7384f

  • SHA512

    d4e9270050b7704ce5e921f8840e09e4a589e70f019648aca8463ce4d449b2f67c3fd77d9cbd8b866162378d33b87f7f958d8597bd95cb9d2c018b88254a1ba1

  • SSDEEP

    6144:UhnkXDKb2qlouDXCLVUOuxZRS0ohly5myleAWLYluevu9pNw9:LXE2qlouWOOuxZwM5mydcY4em97

  Score

  10^/10

  smokeloaderbackdoortrojandcratredlinesocelars1337mario_newnam5evasioninfostealerratspywarestealerupx

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detects Smokeloader packer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2