Extracted

• • Target

    09823fdad990d459244ee4ce3d530047259506e56904fe853efc88f7d14f45e1

  • Size

    213KB

  • MD5

    00328aea700ff0f10029bbb1a7daad86

  • SHA1

    914dac5f4c7bde6b19652279527d1436b8b11642

  • SHA256

    09823fdad990d459244ee4ce3d530047259506e56904fe853efc88f7d14f45e1

  • SHA512

    a6ed2db9c943ebf5472317d6735f2a23177c84fcd1ced256b27624ac733d010d52942145da5a3a7fc999455b8c40b9c880f37eddbd4c9950623155029f091f65

  • SSDEEP

    3072:qXp1aDsLYF2ag1GIV5foKsf8iTnQ9xN6JXhF80K/4e6Ey:KjLYFNITst7Q9QXhF805E

  Score

  10^/10

  redlinesmokeloader535backdoordiscoveryinfostealerspywarestealertrojan

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1