Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    80a0bba7b792fbc7c7cf87ac783aa2f6.exe

  • Size

    916KB

  • MD5

    80a0bba7b792fbc7c7cf87ac783aa2f6

  • SHA1

    da8cd451ed909d3845a59533b96a5490d1217214

  • SHA256

    94c44d916b27f693a843dc746fad3f2fa3c7b2d85e8a5c6b35b163e7cf6f5237

  • SHA512

    0cf7ab4cdfb504e5263898aad5b424028ee94811860d4a1805aedc0ba338d0ecd94e1d52485e1685cf7812d9ab94d48a2a433382e597400a3b0bd73aeba3a704

  • SSDEEP

    24576:VmtwIVsHk1r1HHHHHHHHHHHJHzlagz3lt:MVsHk1hHHHHHHHHHHHJog

  Score

  10^/10

  smokeloaderbackdoortrojanamadeyasyncratgluptebaredline5141679758_99defaultkolyansuperaup3yt&team clouddropperinfostealerloaderpersistencerat

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2