Extracted

Extracted

Extracted

• • Target
    aa794a903dff28c7743cfc00ecd73352.exe
  • Size 295KB
  • SHA256 6069d1c32fc6a41904891daaba7ccc980fc18ea2e58701f94d0e2de77464eb9b
  • MD5 aa794a903dff28c7743cfc00ecd73352
  • SHA1 d721015b3a65f5eed47345330ef8c5c8f6b94817
  • SHA512 a15bcc71c1c34779a609570945dd6ea9aa6f3deed74536fa7da6b76da809af2878c1515aac558eae7463ea3f39aaf1759f1f55e3d59a09293ea4c03dd63dc6bb
  • SSDEEP 6144:Gt4aah1PaxL9FsGrCKSTE7ITsqeewVf6XO:Gw1ixxcTE7RW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanraccoonredline17aad1e8aa2ca5164d7690cff19263905559333547b6d5c69ea798fd93c66d78435discoveryinfostealerspywarestealer

  • Detects Smokeloader packer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2