Extracted

Extracted

Extracted

• • Target
    74BAFD56C1FB3CDEBF0A63DE4FFB6F16DC1D5CEE38E11.exe
  • Size 5.5MB
  • SHA256 74bafd56c1fb3cdebf0a63de4ffb6f16dc1d5cee38e11ab0d2bc2614538da65f
  • MD5 ca08876db58056ad35cadc2afeb89ab7
  • SHA1 e18efa556280140ff92048fa499d729aa4bce089
  • SHA512 c801c8019c911e2e298907fb5ac116d635e4a6b7227db7547908653f7cd680c0ebf71dba3660b8bbc87cfe3df4f8c6fbc332f11cb719466d5b311e7a721bfa27
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinevidar706937pab777aspackv2evasioninfostealerspywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2