Extracted

Extracted

• • Target
    a8b4c6a2c8396eb12f501f3ecf62d042.exe
  • Size 268KB
  • SHA256 64a3c120cb987ccbb5228df2929a26e8e6b5a736bba86f133aec9a314c4ada47
  • MD5 a8b4c6a2c8396eb12f501f3ecf62d042
  • SHA1 6827410c231c4ee2d43051125e3eaba51e4a0183
  • SHA512 b1750f636b2a3f4409ec8493cac01f6c1215ac3816fe2761f4328082842822615f511a700c3f58b60b65eda88434c85dfd29077e5519965e31c180e6d5fed427
  • SSDEEP 3072:Fm0XOIHL6LyxuAhBAUGLfmlk5rqX8NG8zpT8bHraRt9AIDsP0mlpDKM/h3gU7:Ew7H+LyxzA/Ludsrp2yAz0wgj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinegoogle2slovarik15btcinfostealerspywarestealerupx

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2