Extracted

Extracted

• • Target

    3e33cba3607467b99b975f6b69b90dfa3d63fc670e844.exe

  • Size

    320KB

  • MD5

    d4fae7a6d40bfaced3456d116c06636b

  • SHA1

    08be33fe4ef5d9600b401b8d188da09236fe6ad8

  • SHA256

    3e33cba3607467b99b975f6b69b90dfa3d63fc670e8449f37dd7c3356ec39fd3

  • SHA512

    38788407eb16e8583099a0ba82c90e9c02fff037aba46b5fd381db87c7ed74a3625b27fd5e57fafa93c4ad08a7499706656630d45e47c7724762d79ce04ed471

  • SSDEEP

    3072:XE1wAS2i/i5li6Y+VcuOuNMxCnFSe2KdVDAiFJRgO0VggjcGkNIVqIV7:uwAS2iapYacuO+QaJrDR3RXw7ITsq

  Score

  10^/10

  smokeloaderbackdoortrojanamadeydcratredlinegoogle2slovarik15btccollectioninfostealerratspywarestealerupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detect Amadey credential stealer module

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2