Extracted

• • Target

    842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49

  • Size

    223KB

  • MD5

    bfbfca5f9c558bf3171f999ba3459d12

  • SHA1

    ced296dd2fa34b9b52cdb01e238af34dd8414399

  • SHA256

    842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49

  • SHA512

    59150c481eb0544897b09c53f52cd00f1068f410234c947ab24e96948713d6fb129ac01a98a747d84d918003555c7177e1cf40abd1cb099e2fb0d43ec0ca72a1

  • SSDEEP

    3072:WDwILGHLb55+98kVwAgmv9LKxW42MLauDgI7H4f/ln:qLGrfkgm1XMLaMgIS

  Score

  10^/10

  smokeloaderbackdoortrojanredlinebundle2infostealerspyware

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2