Extracted

• • Target
    ab606f1f97bbc65edd55952a2daf2252.exe
  • Size 213KB
  • SHA256 2123f46b435c2e8765a882624a35060d86226424c97a2b2a9edad4b75bd0ba3f
  • MD5 ab606f1f97bbc65edd55952a2daf2252
  • SHA1 1ec0354c1f2a2ef61f3193511ea172f947734b13
  • SHA512 483f86ad28e5c61a52eb8d874d82fbe559f3386b189b5e856fd5fabf9ad3fa604790828164e4e6249462fefb7183ee1f9f4a3ab93166501f29e740510eaafdac
  • SSDEEP 6144:Tv2LdFDqNR8H1N108GtQlOM0d80N6tzOZ:Tv2BFDqNRMN108iQlOxN6ROZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredline535discoveryinfostealerspywarestealer

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2