Extracted

• • Target
    98d10b62db545e1265acd1e02042f366.exe
  • Size 154KB
  • SHA256 8bdb4f4788feb9f22e0f2f76e856a835f5a22baf24a8f8e4e36ef965a23f040c
  • MD5 98d10b62db545e1265acd1e02042f366
  • SHA1 319a28c43b47f46f02ce4bf85be41b4b7ecf8b38
  • SHA512 7f43f4581d6548ccf86e87039e42bcc310c2de6c47f3d2fc75dc671b5570eef03246631b10e8d4e8628602d80a9c6b9778ac5912ea3564a1e89850a488565c3b
  • SSDEEP 3072:yooLLCSMwjq5ntcgpbmSVeROdTJ1MrRI3RU:0LLCSfWtc8mSIOly
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinerozena1113discoveryinfostealerspywarestealerupx

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2