Extracted

• • Target

    a97b870a122b389630c0afde52083a35.exe

  • Size

    303KB

  • MD5

    a97b870a122b389630c0afde52083a35

  • SHA1

    fb434a7c4ed01009d50e728ff7144779a8d149cd

  • SHA256

    98895be0f996ac647bdeeaf84bee094a34a5119d16ad4765ecd0fdeedd5dbe40

  • SHA512

    f6f7299b62dab43963589a49043e41e8efd419ff476afcf8564d513571fbd53e4f6f1e057038ec6648c6aa950f90cc62a702a81657cb62fbe8fd7ad48de222a7

  • SSDEEP

    3072:rJRT8/PSdxP5FushlZvUy/j/3Cq3pblHTF3fvVBO5e6asNKOu1e7eocT:1RTfB55v7bSS5HTxFByesAOu1eeH

  Score

  10^/10

  smokeloaderbackdoortrojanredlinegoogle2infostealerupx

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2