Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    e07844a91b58860b281984d1f51f97ef22bfaf0052a715ba57f98d5efc04b2ad

  • Size

    883KB

  • MD5

    cf04b5b0076568037fbf85024ba879f3

  • SHA1

    be2b479689cd59bd6ff8a2cad31300e138470b2f

  • SHA256

    e07844a91b58860b281984d1f51f97ef22bfaf0052a715ba57f98d5efc04b2ad

  • SHA512

    e42796401bfee7642eb902b39bb92e344490b974614ff70ad6022ce2f5762623ed5e0a25e9332471675cb03ba2f09cf330133c57ee9dd5c9dd7917ed66e2c7c4

  • SSDEEP

    12288:S+hAo5KADW9g145x58OpGH2EJ/qdDyyZpxThSGu4yw0gB96eXI/9:SEDW9g145x58Opc/yVzSWHXw9

  Score

  10^/10

  amadeygluptebahealerredlinesectopratsmokeloader6012068394_99@ytlogsbotpixelscloudup3backdoordropperevasioninfostealerloaderpersistencerattrojanbrehakukish

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2