Extracted

• • Target
    Bitcoin Mining Software 1.5v.exe
  • Size 4.6MB
  • SHA256 773b40c8007545afd1b563bdf17dab8225acd4bd6def35e4db95f70fca16371c
  • MD5 c9b0c2b2a7988eb97f7069bb423a7ffa
  • SHA1 85d72dd1cdf60d9dd4c2696d950e63d163102c37
  • SHA512 88dfcec430d3cbb3eaf63611373f38a17a0a752d2d42566310d7f5275acbb8d82cfa3e8e58def6b0ed4e10e062f8e77fd2b7536c0931a1a8ddaba89a236c4e92
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline@estetikasellinfostealerspywarevmprotect

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2