Extracted

Extracted

• • Target
    837547af8d2a1f60f8bbe09066f0ffa2.exe
  • Size 692KB
  • SHA256 fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f
  • MD5 837547af8d2a1f60f8bbe09066f0ffa2
  • SHA1 727421a8ea79d0c0562870c33d055224c7c9a4bc
  • SHA512 579fe72723076eb6605660258caf1b8b2a2cf4f05c50f15c0a6a1d8226c13eb847ade0230e5bb1ba21c820e6b2ae0662b33725e65f7b43e0fb2f98c4e41d6961
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeiredline04062022defaultdiscoveryinfostealerspywarestealersuricata

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - %APPDATA% M4

    suricata: ET MALWARE Base64 Encoded Stealer Config from Server - %APPDATA% M4

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2