Extracted

• • Target
    37ce83ce94515aa5df8c065b7f31c024.exe
  • Size 286KB
  • SHA256 82b006ca48e7abf59cb59050eb286b8d7e14374637d11170a569a12a63de74f7
  • MD5 37ce83ce94515aa5df8c065b7f31c024
  • SHA1 b849d8df833bdc5327ac6c719017a16123bde31d
  • SHA512 74ffe6382a92ee589c4413ab27e8fd56d38d778d5bab3a00d01ccf5b836da53ca0246d4daa71369e7134116d17c4c0b9e3088933112ee044dad395fd14ccee8a
  • SSDEEP 6144:0UEv+LWruMK90d3Z1p1/mNCQGXx3fTNKM0rc:0UEWM20tZ1m4DxbAJc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinegoogle2infostealerpersistencespywareupx

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2