Extracted

• • Target
    file.exe
  • Size 270KB
  • SHA256 d760bcc24f920cb5dad3deb0728e979d3476fda9f75f6b515ada91ee44bd42b5
  • MD5 824ee70fcfc73d6fb33e26a44605001f
  • SHA1 e6d98827aa85c83433f810481af7bc3c5d003479
  • SHA512 0aba1e2e46b967c77c1e55ea54e7bef02dbf6bbcc35e6f5428268d6a23f916aeca3dd07ee68e4ac53ebf66079533dc70000ce752ca14961d2d9019871efb5fb6
  • SSDEEP 3072:kX3aKBD7iIA095gSLEZrW7DTLElQewrhzQvSUC+DZQt4qndE8SUlutGm:g7BC07Er0LAQPhzeZ+LdKt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinerhadamanthystestedpotikuodatedcollectiondiscoveryinfostealerspywarestealervmprotect

  • Detect rhadamanthys stealer shellcode

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2