Extracted

• • Target

    48b427f4d40f61209cb7be06c1d47c13ce73f6ce5887e37228c6f572ab2994c9

  • Size

    186KB

  • MD5

    b2850332aeb039fa7d26128c37071815

  • SHA1

    6df0c8e9c8e6bf078b60ea6dbe869911a08c0646

  • SHA256

    48b427f4d40f61209cb7be06c1d47c13ce73f6ce5887e37228c6f572ab2994c9

  • SHA512

    13d32614e506c056c8093b45cfce3d1f9e8b40f82d9d771c7d589d16fc922d4d30d97511d26cf624837108c5b364c3e2f7092b76555845ed107b88c4fe12aa28

  • SSDEEP

    3072:cIKy4vY2FjL8BgWH/Opk5F42vWBVXgpFoTW6NLI/khRLkeozGMw2AIhe:cPyaL8BgImriWXgpFoTW6ZI/CxoC6Ax

  Score

  10^/10

  redlinesmokeloadernewbackdoorinfostealertrojan

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  behavioral1