Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    0x000600000002321e-639.dat

  • Size

    38KB

  • MD5

    251a04dcae43d733a7beff1724f99fbe

  • SHA1

    834cd1e1c218ac4a71003cb3151acb0cff0ef073

  • SHA256

    a1e4f033baf6ddddff930d3e0da1020e20bc79cb053b5ab525252778a8c1f06a

  • SHA512

    f8177efc94121708127518d7ee8d6fccda2a8b6c6859021646f60d8897ece75c8efaef864d42e31603e8d660b8124c7e33a4a23501b0997faa42eefe4e296786

  • SSDEEP

    768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3

  Score

  10^/10

  smokeloaderup3backdoorevasiontrojangluptebaredlinestealc777livetrafficdropperinfostealerloaderstealer

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2