Extracted

Extracted

Extracted

• • Target

    fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f.exe

  • Size

    692KB

  • MD5

    837547af8d2a1f60f8bbe09066f0ffa2

  • SHA1

    727421a8ea79d0c0562870c33d055224c7c9a4bc

  • SHA256

    fb368927d9051a0ed52610ad43849d1b0cdf2acee3bb1bf88c63e3fce54a4f0f

  • SHA512

    579fe72723076eb6605660258caf1b8b2a2cf4f05c50f15c0a6a1d8226c13eb847ade0230e5bb1ba21c820e6b2ae0662b33725e65f7b43e0fb2f98c4e41d6961

  Score

  10^/10

  arkeiazorultredline04062022defaultdiscoveryinfostealerpersistencespywarestealersuricatatrojanmetastealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - %APPDATA% M4

    suricata: ET MALWARE Base64 Encoded Stealer Config from Server - %APPDATA% M4

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2