Extracted

Extracted

• • Target

    c45365acb54ee1edf3eda04ca895367520f3dcc86772c8561ba6eca0479fe331.exe

  • Size

    192KB

  • MD5

    776d703ba06d6334fad959d7c305b8c2

  • SHA1

    c1bacae38027067a911c382af96c7d5ebc210fb8

  • SHA256

    c45365acb54ee1edf3eda04ca895367520f3dcc86772c8561ba6eca0479fe331

  • SHA512

    11e4bce2b251a9b3d1504ed23aa69a832697bb923db5290eab78c6e4ca38180e65a32500f61756325e156156ed85d00e257c7aaaed72cf3ffd9b1c851a24801f

  • SSDEEP

    3072:V4c4SvQ/YIF1avmmFxFhxmtrU5CxKfJDOZwI6TTA3Uwfyz:Vr4J/YIzC42CNPOOa

  Score

  10^/10

  smokeloaderbackdoortrojanredlinexmrigrumfadiscoveryevasioninfostealerminerpersistencespywarestealer

  • Detects Smokeloader packer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2