Extracted

Extracted

Extracted

Extracted

• • Target

    95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a

  • Size

    303KB

  • MD5

    566a85715428e226f1c5d48ca90b9e15

  • SHA1

    f252975240083fd3ce4ff62a059d6dab226dd41d

  • SHA256

    95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a

  • SHA512

    2d716809dc374f5cc74f58e3ffca09d2bc7bbff8d27eef21ae768b9ee2148592b2572b194323fa64b814734b1a141d9c05db9a060f2c8e1080a566fc16672e4e

  • SSDEEP

    3072:phLIBaL3BklS19u655D+kMxqrnRdFe1soM+e5CD9iwlgZDGW:PLIYL3BkgCS5vLejMID9iFG

  Score

  10^/10

  lummaredlinesmokeloaderccsummbackdoordiscoveryinfostealerspywarestealertrojan

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1