Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    0f0786d2a98feda89413e80bfa9ef5aa.exe
  • Size 276KB
  • SHA256 3d52e472dccb590859f2b385e06076096357f1b9521ef9c01935d8dbcea513a0
  • MD5 0f0786d2a98feda89413e80bfa9ef5aa
  • SHA1 a71e1be1893c7b938866058780e8ed8ea22b29de
  • SHA512 3a5a826801e9d4ed770c1dd4a20ffdffb3eade2421ae975bf3894e1bf31f1f1d792edab2626bf803b53b71e8bb96e245e0256fd39983c6e15aee9abea3e81823
  • SSDEEP 3072:RPNCLO2Kt156qKVWtdplLFxCwtQasNJYGg4KiyJZNOloqJe+E5l5nxiig7b/6PQj:9kLO2KQYlETyliNoye+yLZwCMXCa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyredlinerhadamanthyssmokeloaderpro100traf%557trudbackdoorcollectiondiscoveryinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Detect rhadamanthys stealer shellcode

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2