Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    c20b34625df01f32a1d37676bfe43c84.exe

  • Size

    386KB

  • MD5

    c20b34625df01f32a1d37676bfe43c84

  • SHA1

    498b6c87b8d1a616760f3e4e550f4650d5b64dc0

  • SHA256

    33e7df640d73c684871ff3828d1813f000c7a179e06a72f50a2ddefaac434bc8

  • SHA512

    5d5c1330098247bdf94abcb4c5f2b0235fe67666efc1da7e0e05796563c000c521b41d70b67457514b88a680117ce8d3f7be45438bdc42e7fd0a6844fc9480d8

  • SSDEEP

    6144:lVGhtukSJDYkJUXxzp9TNmrkl9BTgLUebH/i:lVGhtukS9ZOXVNmr8rTgLUeL/

  Score

  10^/10

  amadeyfabookieredlinesmokeloaderinstallslogsdiller cloud (tg: @logsdillabot)lux3summbackdoordiscoveryinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2