Extracted

Extracted

• • Target

    34dc14528893caf025173bef0104f2229adb26c23f0bd5cbb4c6653d80c306ba

  • Size

    231KB

  • MD5

    835a1fad6b22d9f656514e6450243fea

  • SHA1

    ad7dce22f1e1b66a28f4b6caf2ebecae0fe075cc

  • SHA256

    34dc14528893caf025173bef0104f2229adb26c23f0bd5cbb4c6653d80c306ba

  • SHA512

    e95304f0c388794264286584cbf4487588a6952e54290c9181a8559585ad335e41d0984697ea28140f47d72ea776a240c2975aa29293c66c8e3afacecdc0adda

  • SSDEEP

    3072:4qPkLtGo5D5zN3l3y5C1s0TwPxFwRtJ/nJJxgISNPw7RkxmJZs:4zLssdj3y5C1uw3J/nFgXNPGymI

  Score

  10^/10

  auroraredlinesmokeloader11backdoorinfostealerspywarestealertrojan

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1