Extracted

Extracted

Extracted

Extracted

• • Target

    6d487120a2080a06bc121647ba6e29002cc026b36015526dcee1885bd96e1d2b

  • Size

    257KB

  • MD5

    f8506003c9b522313ef6d925ec5d607b

  • SHA1

    b89aea4c53f30d8ad1c3919f9054869cd7e88781

  • SHA256

    6d487120a2080a06bc121647ba6e29002cc026b36015526dcee1885bd96e1d2b

  • SHA512

    5019b680c945df5ac363c4ecf6e4cea7ddb96512923c3092a8a3b973eb8dd8cc64de45af7ccd7544036948cdaa7eb46082f4cd59bc78fce0d4a701116b226b1b

  • SSDEEP

    6144:ewOTmInU3SPmZbHh3Y/feAOTfueHvw216NfYyUi9:ewuU3SPJ/2geHqYyUi

  Score

  10^/10

  fabookiegluptebaredlinesmokeloader0305up3backdoordropperinfostealerloaderspywarestealertrojan

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1