Extracted

Extracted

Extracted

• • Target

    0829cd6ebf13b1aa2b01403d19b392ce396d4405e9386fe208ea9b542a625c1f

  • Size

    11.8MB

  • MD5

    d7fd6731e4db6fdac15d7ce4844254f0

  • SHA1

    32286ffae51a5bc0f14bcf6f7cc10d5040abd8c4

  • SHA256

    0829cd6ebf13b1aa2b01403d19b392ce396d4405e9386fe208ea9b542a625c1f

  • SHA512

    5bb7f1731c892300d67aec81eaa48788690b6abcd9fca5f81dd8830d481d9e6aaf1fa766153b94ad450b6a346b1f48fe8ce4b449062ac476b5ac2cc244315d73

  • SSDEEP

    196608:I1rT3Lk6XhNQSKwAk2V80t5AtgNtKpXeBHsepB7/nqlKBlIgj:irbLPXhN1Kpk6t5AtutKpOBppRln

  Score

  10^/10

  redlinesmokeloaderstealczgratwork28.7backdoorinfostealerratspywarestealerthemidatrojanvmprotect

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2