Extracted

Extracted

• • Target
    e95d92772e18190dbde834744c74aa2ab7fda3b01e1ca839fabb8a4285b4e148
  • Size 1.6MB
  • SHA256 e95d92772e18190dbde834744c74aa2ab7fda3b01e1ca839fabb8a4285b4e148
  • MD5 16a11f50f6925fca61040f2e0a834b89
  • SHA1 4179ea5b096750082e177dddedf3a46f1576ef91
  • SHA512 309b46e3e09e77a96a3ecc06a06a62fc7111e15383aefb8eed8c9be11c700774749d55f6dd7e2fb172bc74525a52c888e9aac6c49b217e4a0bc3b247676a075c
  • MD5 SHA1 SHA512

  Score

  10^/10

  icedidredline687839456bankerdiscoveryinfostealerspywarestealertrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2