Extracted

Extracted

• • Target
    89DAC1423E1281902DFA3501FED124B1.exe
  • Size 2.7MB
  • SHA256 4bb9bb8442b8bb68a5ebffb308c5d2f2212fa33b04a0f4de87dbf7ca1487dc1b
  • MD5 89dac1423e1281902dfa3501fed124b1
  • SHA1 21e5ec36467c2c2e15f4e699f28d84d629fcd077
  • SHA512 1ba1b83fadc69daf9a5c2dd9ae1e0d9f089d5ee3a917eacd77f2f9dbf0da02465b5c0df7bb45332e32062566b8c7ae6142f0779ac91f25280d5d03ff44e5b2d0
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderaspackv2backdoortrojanredlinevidar706infostealerstealerthemida

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2