Extracted

Extracted

• • Target
    82325762a180422476ba6f3accfa2d80.exe
  • Size 268KB
  • SHA256 720f2883b2571b10e2f0c6075053c52709bc49174c5602fe06aaeeef9e8eff41
  • MD5 82325762a180422476ba6f3accfa2d80
  • SHA1 2bb143f1221dda57180ee2afb845f01a572fe7f8
  • SHA512 59b26129867953b41296bda5e120f47f1effa188f58d95d7bf14dfc4234e05b9712346e0e39b9395a9692ae1e2d3e95b72f7c2205fd6869b4becd7eedef2e8b3
  • SSDEEP 3072:ym3XOBxHS7LYlcAEKuoGBfmlk5Kt0RkCtPadszAVwoBv/IOxvgooM/h3gU7:/n0HgLYlJubBupt0btDroBvYooj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinegoogle2slovarik15btcinfostealerspywareupx

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2