Extracted

Extracted

Extracted

• • Target
    832779cea083c3399318340f613e8a63.exe
  • Size 222KB
  • SHA256 31a05be935773dbbcf90bc69e0784abb5e269cd009a4498d48e0c4a3c84e9d67
  • MD5 832779cea083c3399318340f613e8a63
  • SHA1 0463a5e44c6b9b407a9404a7ae056f663fcf4a15
  • SHA512 9d6f37543423bade3d8be38b0b8af0538897e67327f880da25580519e6288b3ffaa5b62af3ba5d9c08881df6c0b8fd299b77ec0b1d712062511b7974e5410a73
  • SSDEEP 3072:9d2Nex9Xy8SvyGowCLGrZ2wXt6sk5jRp39UJDv25SuWLX1iHFjTQ6LWI:9dhxVACLsXtF6/9UB25SuWLFyk6L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinegoogle2nam7slovarik15btcdiscoveryinfostealerspywarestealer

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2