Extracted

• • Target

    cb66f6c4f4c980acc9c6f4d62a1effaba3dd97d0cd7ff1574f39768f92e46f3f

  • Size

    301KB

  • MD5

    9acd84142c3c8f65fd60b6ff81c6f7f8

  • SHA1

    b2b7f9462d10537542582fcbef19f8eee468952a

  • SHA256

    cb66f6c4f4c980acc9c6f4d62a1effaba3dd97d0cd7ff1574f39768f92e46f3f

  • SHA512

    793c2874464bb2ea1e7b168ffe34d57dd4cf861dc4116f121a04c0e980a006e3d724d5575bb249ecb9b0ee2ef6067675e14a593775e5e04e46c12a2bc9a5f849

  • SSDEEP

    6144:SmFSmmtANMYHqGgvoy609yc2GnigabwVf:SESfSNMYHqGQlEc2Gi

  Score

  10^/10

  redlinesmokeloaderxmrigdark1backdoordiscoveryinfostealerminerpyinstallerspywarestealertrojanupx

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1