Extracted

Extracted

Extracted

Extracted

• • Target

    d84e4b0534ed220ccf52b88a274f941fd20cf74bf0b9ee7f5739ec562e9a0d3b

  • Size

    240KB

  • MD5

    1e22f9fbbb941fb2a676ad9728707732

  • SHA1

    05176d1f13a6c8d3fdaea7adfc363b1d19ecb8e5

  • SHA256

    d84e4b0534ed220ccf52b88a274f941fd20cf74bf0b9ee7f5739ec562e9a0d3b

  • SHA512

    48cc4d4b0b4be7f15e8e6d91fb2450e1babbca83c39170a56948605c23815b52f8488c838c0dce11ad089e4678b698acc1c85ed942d515ec9b8b8f50c69e0a0e

  • SSDEEP

    6144:Gb5frpxdonyq4zaG2u5AO5eK97a6oquqp:G1rp0/9u5/eFquqp

  Score

  10^/10

  fabookiegluptebaredlinesmokeloaderup3backdoorgooglediscoverydropperinfostealerloaderphishingspywarestealertrojan

  • Detect Fabookie payload

  • Detected google phishing page

    phishinggoogle

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1