Extracted

• • Target
    a97b870a122b389630c0afde52083a35.exe
  • Size 303KB
  • SHA256 98895be0f996ac647bdeeaf84bee094a34a5119d16ad4765ecd0fdeedd5dbe40
  • MD5 a97b870a122b389630c0afde52083a35
  • SHA1 fb434a7c4ed01009d50e728ff7144779a8d149cd
  • SHA512 f6f7299b62dab43963589a49043e41e8efd419ff476afcf8564d513571fbd53e4f6f1e057038ec6648c6aa950f90cc62a702a81657cb62fbe8fd7ad48de222a7
  • SSDEEP 3072:rJRT8/PSdxP5FushlZvUy/j/3Cq3pblHTF3fvVBO5e6asNKOu1e7eocT:1RTfB55v7bSS5HTxFByesAOu1eeH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinegoogle2infostealerupx

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2