Extracted

Extracted

• • Target
    file.exe
  • Size 173KB
  • SHA256 a59e09b73fddf543db558f2aeba8302a9e82174ee54e3e76f82da34d273e931e
  • MD5 d43a1ae1d5ca41931a22a23cf2a958d3
  • SHA1 3880bb51b6e10a7d38d98aa5e915213f69b71c0b
  • SHA512 40dc3c9897f8ed523a05a61ae0dc5eea47a93d5bfa14b05241016bbc4d7c0749ab1d49ec7d5d1ae055c64b46074ec9b03f1f7913d460ada23d97e895ed136ca8
  • SSDEEP 3072:rXEvsIOJr42Aoun/R057hFBYfytKYV8ZyQqtXvOb7dj:DiJVn/R2hFBYfy4YGspBOb7d
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanredlinerhadamanthystesttest3collectiondiscoveryinfostealerpersistencespywarestealer

  • Detect rhadamanthys stealer shellcode

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2