Extracted

Extracted

• • Target
    47c96fae088849b0688d8fb9b9bc912d.exe
  • Size 194KB
  • SHA256 0d768d53c48bad8d7d80f7865d4037dcb695554d746cc47a088b4d82a0f2de26
  • MD5 47c96fae088849b0688d8fb9b9bc912d
  • SHA1 3f7056c88cc969839da1bec05d5377e9a030710c
  • SHA512 178841cb476ff98cd866a0bec87b47b11483596b461ad4106da16061ff7eb3909543addd4c001bfc9df6c7072d8925447c59763fd65a507ed76fcbb1c75d248c
  • SSDEEP 3072:PBN0XqPk+S8LWvFSS5pG9RBOh/dNOZMpp/6ayUfF6MK+uO/MG4Y:JiqLWNSUqRUHNTpp/oUfIL+uO//4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinevidar237anydesk-usadiscoveryinfostealerspywarestealer

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2