Extracted

Extracted

• • Target

    35403f7d3e39183ba3ff49f757d0bc4a89898c530baa8430a55b327f65b62579

  • Size

    240KB

  • MD5

    35b5767fa390b0353f383c331dcdd932

  • SHA1

    ac1317f02010dd90758740ef44ca177e63d187b5

  • SHA256

    35403f7d3e39183ba3ff49f757d0bc4a89898c530baa8430a55b327f65b62579

  • SHA512

    a6411189ffbf7766063a15c0be0f6a6100b3a7a441843cfe70280351bf2dff14877af74e9d44aac439de2c11e502227cd719db43340c54d76ce1dc557e0ef8e2

  • SSDEEP

    3072:jM2zE5Mno95B0Z4tu6pxdJKnyqx/doHzaGLnaVRZiTyaUDeAg0FujDeVwzK55iLU:j45frpxdonyq4zaG2u5AOWeKKZquqp

  Score

  10^/10

  fabookieredlinesmokeloaderbackdoordiscoveryinfostealerspywarestealertrojan

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1