Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    b17247d929c31c0ffcd0606b6fc4cf462da2ab4fd858ffbdfdfad3479a7a145f

  • Size

    275KB

  • MD5

    a3977cfffdf7d761f023b079f9112fa2

  • SHA1

    8571c879fbfc226e8317612d1bd2f5e1d5a41f0a

  • SHA256

    b17247d929c31c0ffcd0606b6fc4cf462da2ab4fd858ffbdfdfad3479a7a145f

  • SHA512

    0e358d09fdffb9a8c34fecb4a48f56e220b51b094f0a8fa58d5553097843c33b8d711e2cec6e803d20499f8a76ff32eec3cc22e84fe7660fd6bfde02ce255315

  • SSDEEP

    3072:33pUWxKhzuaeyUwCYuk4rbZ6vnrS/CWn2niJKuJbuVqpN/GRpNN4TJY:6Nre7wCkvkCO2iLJaV2N/SNN4T

  Score

  10^/10

  redlinesmokeloaderstealcsprgw1backdoordiscoveryinfostealerspywarestealertrojan

  • Detects Stealc stealer

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1