Extracted

Extracted

Extracted

• • Target
    7aaf329d75d5e7ab8ae8f4287f267c48.exe
  • Size 211KB
  • SHA256 c2ffdac60cc6beac59fba1a89772be3bf009ed3a60829b17331cd06cb8876cdd
  • MD5 7aaf329d75d5e7ab8ae8f4287f267c48
  • SHA1 198948281ef1fc9a76974eb5561885bea8b68664
  • SHA512 52a08dddf1b48dc74a03d0a40bf631df129e9d552c01e96f2db5903924e0db785569993b3809bf504c2a33a011f49de1c4fa5e9f09bb30de6ccc7f791ce7e974
  • SSDEEP 3072:lO6zPHZQf8FY6LDPWbKfq5jAaYZRo1anEf5sLAfBiVdS7q2Oynssmx:lOQH6f8FdLDPOKM82pfGAfiE7DOynsF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojandcratredline31.10google2slovarik15btcinfostealerratspyware

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2