Extracted

Extracted

Extracted

• • Target
    48e449e1f4675e90d8459e34b94af13b110c9fc361e3c75ae3bc4c736bda223f
  • Size 229KB
  • SHA256 48e449e1f4675e90d8459e34b94af13b110c9fc361e3c75ae3bc4c736bda223f
  • MD5 7cd60d431570382f1e525091d2cb74c1
  • SHA1 cac637a6bfb1a6b5d4f05ce27d17e3534c2be896
  • SHA512 d6ee093ac0a35a549fc275d78aeed2462b0d2291c6533309eaed642697190bea8bd98f34d8820f4c5360cf25e93033ac661dfa4cf71ce9d77ca19d037ba3b7be
  • SSDEEP 3072:g5YgNN4pwBsgLedt81gd6CrmezSzUkxrsf120HOR4fCjR4iGj/d:g5NNnLed+1OzD0af120HOi+xGj/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinesmokeloadergoogle2neweslovarikinstallsbackdoordiscoveryinfostealerspywarestealertrojan

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1