Extracted

Extracted

Extracted

Extracted

• • Target
    8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa.exe
  • Size 240KB
  • SHA256 8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa
  • MD5 817d3b2845b7869b9fc71086755bef75
  • SHA1 62afe642e08e778593a54c053af79cb2efecbe6b
  • SHA512 23fa2f5a78a1fcba86ec53b509d05fd8134a8d6466cf7aaffd7e39ef7ab812607eab0c40faea7512c4defdaa1c74ca7872504c5fae5597e3e0ae81bb990f453d
  • SSDEEP 3072:GHAEvKLe+EtqHInlgz3OWtd6IwYbF2u5u1SkLRaQedb:nL7EXlgzzOI3beUJ5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderpub1backdoorbootkitpersistencetrojanlummaredline@cloudcosmic (https://cloudcosmic.store)discoveryinfostealerspywarestealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2