Extracted

• • Target
    609e4a8b5f5df82b0dc47275db50f4de.exe
  • Size 362KB
  • SHA256 d22d7ec3a9db9edb88cd373986a8aee46fc90bcb1339b147880301351d5ee522
  • MD5 609e4a8b5f5df82b0dc47275db50f4de
  • SHA1 91be8fa9a330fb3e842f9ab1ff2db5bc78f9eb5e
  • SHA512 9946cdf7b39fcb895e2cce27e2c6694369012a6f1ce53579f99878830960f0f94e84f550e0cb1ef36696a4403868ea73ddd21f6ca73c40ddf9d2b47728b25cef
  • MD5 SHA1 SHA512

  Score

  10^/10

  bitratredlinetestmixagilenetdiscoveryinfostealerspywarestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • BitRAT Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2