Extracted

Extracted

• • Target

    a6e18bfafb3e216ca77d6f5da1cd50ab.exe

  • Size

    309KB

  • MD5

    a6e18bfafb3e216ca77d6f5da1cd50ab

  • SHA1

    585c6092b0036ee0f96032e203c0d764d1f012d5

  • SHA256

    e387e0ba5e2fb9355e78d28a92edff5479c15e327f6e4e97a3cf42c27e00e85f

  • SHA512

    f7d20c8e7aa394a66ce359286d9688d1aa0e5292dceaced469dbc69c347b807d1b102a97d4b8af04ef68ea92efa47bc752cbbe697d88ec26fcb0fd4050d1cb91

  • SSDEEP

    6144:oB1nazUTsjsAvrirn1yD0HrfdDa7MJGy4USuvf9vE1o+gfqoFLPS:oCzUjAvmrnMYHrfdDXG3mf9vE1BuqqL

  Score

  10^/10

  smokeloaderbackdoortrojannetsupportredline1337nam5infostealerratspyware

  • Detects Smokeloader packer

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2