Extracted

• • Target

    8.exe

  • Size

    1.4MB

  • MD5

    d1a30dcdf2bc6b49b6472ca8bd35751b

  • SHA1

    874e9436d4f9fb6e752b5937f032186501bf16aa

  • SHA256

    03752193cdcfed264b430381b7634c2a27cce45e3c3fc0b85470017afbdb54d8

  • SHA512

    b3eeef39477c6776ad78ee14c08fff7173ae8ad7ca1caea77ae5602dd122dddfa02837d5d062eb687aa211ddc931b3d9d1c8c3725d30e684f84057aed5ee28aa

  Score

  10^/10

  phoenixstealerredlineinfostealerspywarestealerpersistence

  • PhoenixStealer

    PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.

    stealerphoenixstealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2