Extracted

Extracted

• • Target

    s.exe

  • Size

    196KB

  • MD5

    a9b6a110d389bf0c340f6a18f5de9067

  • SHA1

    4c4a81d8f203f164a98894f8dbb9574e7371fadb

  • SHA256

    249b6115c81863c982c3674944c126f350913adfaf217d64b7e442cc9c23dfdb

  • SHA512

    e088df49835af9549fb96e8bf211b7645d9fca7bd570ec7a1c0dea7dba3d587b34c8e9ed78e58dcdb74a3514396b95122f57febc51a2d22b0156810696983a1d

  • SSDEEP

    3072:EEsqMLxJUVRbHc85+OitYTlTLNQZsyCrdPu+k9IBZN/iVU/PkF4x:E3LcVZH0OiEisyCrzw

  Score

  10^/10

  smokeloaderbackdoortrojanredlinetofseexmriglogsdiller cloud (tg: @mr_golds)evasioninfostealerminerpersistence

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2