Extracted

• • Target
    FOXHACK.exe
  • Size 340KB
  • SHA256 f89908f8594a0dccfb5e52b295075ff63be86c0f5584f990d39dfe2b2c2f9c08
  • MD5 2cf73866e155ae916b8c5e23f509b357
  • SHA1 794f4671809e0821dd1785fc6d63ab2f8405b788
  • SHA512 2e676b0c2da6075e524ccf513cfecf817dc72b39602e4a38542672ac959f7c2e4408db58ee69881fd11f27bfad1f52ac4a104f356ac8aa00fdb9ba7ef3f818ad
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinediscoveryinfostealerspywarestealerxmrigminer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2