Extracted

Extracted

• • Target
    e19effaa677cb5e593eb379348d6a5f6
  • Size 296KB
  • SHA256 7d353bce5ec37a378a5800c6a8bad2203d80664ed304e2728010bb69f6fef950
  • MD5 e19effaa677cb5e593eb379348d6a5f6
  • SHA1 f0a13943c488352d3ff22389340d9e7125770339
  • SHA512 2bdf7e255e3e99e175e2a88b8576633677faf2d52eb75bde3c00f199962e8d447ea8817aaf5bffde99bacde809f333e52530f08ad61d8291ee9af04a15990a3d
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinevidar828newdiscoveryinfostealerspywarestealersuricata

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2