Extracted

• • Target

    ae54f01f90675f9268588f7eab938ce7.exe

  • Size

    1.8MB

  • MD5

    ae54f01f90675f9268588f7eab938ce7

  • SHA1

    df9b0a7a6280b8bb8bb866a672bc7ff2736c29b0

  • SHA256

    1b6dd998ab259fc57bf7d9a35381fdfe4f63f80eac561e9842613132812f165d

  • SHA512

    9616b482d4707b16b402722924c755245b36da5b44a04e59b8803058900f66be001bbd51c724bb9a10b933829a356f42f9bab9e5d55a49b60bda1b926da210ee

  Score

  10^/10

  redline@devilstationsix66infostealerspywaremetastealerxmrigevasionminerpersistencestealertrojanupx

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2