Extracted

Extracted

• • Target

    45cd85d238a6fd6b0f760c2c418f729a47084304da890dbe2f85fdb7cc4f49ff

  • Size

    288KB

  • MD5

    812993196ef9efb332aa31f6c5278479

  • SHA1

    c48c8affceb580314a60957f4d119457122d7bcc

  • SHA256

    45cd85d238a6fd6b0f760c2c418f729a47084304da890dbe2f85fdb7cc4f49ff

  • SHA512

    a5349a98193df840ecc106b0e78c90d66246dc914587e8a40754c2a32cfb4a1e922da5180711e8ea75881af9fedd196d589d95f368d6460326990eae68e17f39

  • SSDEEP

    6144:Y5biLlyhXDWxbxMhqugbeco5oFUxx3E5:YQUhXDWlmfj

  Score

  10^/10

  redlinesmokeloaderpub2redline botbackdoorinfostealerspywaretrojan

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1