Extracted

• • Target

    ab606f1f97bbc65edd55952a2daf2252.exe

  • Size

    213KB

  • MD5

    ab606f1f97bbc65edd55952a2daf2252

  • SHA1

    1ec0354c1f2a2ef61f3193511ea172f947734b13

  • SHA256

    2123f46b435c2e8765a882624a35060d86226424c97a2b2a9edad4b75bd0ba3f

  • SHA512

    483f86ad28e5c61a52eb8d874d82fbe559f3386b189b5e856fd5fabf9ad3fa604790828164e4e6249462fefb7183ee1f9f4a3ab93166501f29e740510eaafdac

  • SSDEEP

    6144:Tv2LdFDqNR8H1N108GtQlOM0d80N6tzOZ:Tv2BFDqNRMN108iQlOxN6ROZ

  Score

  10^/10

  smokeloaderbackdoortrojanredline535discoveryinfostealerspywarestealer

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2