Extracted

Extracted

• • Target
    F5C67FE00B4CBEE07D5E394C87F0C6224BBD841A92151.exe
  • Size 1.1MB
  • SHA256 f5c67fe00b4cbee07d5e394c87f0c6224bbd841a92151d04841f584d56e58b0c
  • MD5 842ae8e819177105e1a1af934b1ee520
  • SHA1 17104eca148dcd0e15ffb31e4c7a3defdd406d12
  • SHA512 b92ecfb5c89996332dd674682694a111aee2bc26b21678c9e60dc592272b91a0f6e9d2a478528b6f257290c5ef43ed9d87d7fac3b8314e768144951333e4916d
  • SSDEEP 24576:zXdmFGXOGXlTztlj3RbjO7jlUIixAWLc7ARpTLzVONY/tx4:rdfLVTLjxwjlQntT/VO2x4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  evasionspywarestealertrojangcleanerprivateloadersmokeloaderbackdoordiscoveryloadermainthemidavmprotect

  • Detects Smokeloader packer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2