Extracted

• • Target
    d769e9b86721acecef2b65647405415b.exe
  • Size 224KB
  • SHA256 b40cf8e538f2c6e214fd1393f9fc5d556a91e6e49d7fc3a855e10b29c69fb185
  • MD5 d769e9b86721acecef2b65647405415b
  • SHA1 bb80cf7977ef76ed31e14aac83ff2c66585e5355
  • SHA512 7ed3cd2172f8c31a2116b003ee567379e612b0cceb26b2cfc70021079a8d49e93f1a270b27e166d187d8b11c819a6cd346464c6ceae9b2cfd8ab7066de73b54f
  • SSDEEP 3072:+KaLDoma5+JWwE7GGewhlriXLiexOmDYg0gdx+eNwD3tdmdhxH:ILEm3kS8WXZxXpxtNi3tm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlineinstallsinfostealerspyware

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2