Extracted

Extracted

• • Target

    25662735c61aad88fad33ef29edffbf9ed738556135774da119bb9eadb321fdd

  • Size

    169KB

  • MD5

    747220026ace8bb810f557d9a7d3a9f9

  • SHA1

    9e7e544b460455a9d85959b24a687ac7e8541b19

  • SHA256

    25662735c61aad88fad33ef29edffbf9ed738556135774da119bb9eadb321fdd

  • SHA512

    60640e98d660ed5e9499ef5b889ab2cf38465c8bc1938201a7a7400c72b116de962a4ea3632af8335ab8c5dc4d45143056d26d99400dad50ce296f79bcfd01bc

  • SSDEEP

    3072:sWDL5R45mHq8OjJ1SmZ/gDivi6F0VZBnel6/PkW4n:FLrjH8/BF0tel

  Score

  10^/10

  redlinesmokeloadertofseexmriglogsdiller cloud (sup: @mr_golds)backdoordiscoveryevasioninfostealerminerpersistencespywarestealertrojan

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1