Extracted

Extracted

• • Target

    setup/AISetupFull.exe

  • Size

    1.4MB

  • MD5

    0d5e2cabef77bed22398de3196c1d1fd

  • SHA1

    785ff4ed2cdec5ba481ec00a2966a8ea766cd549

  • SHA256

    757cdbf9116e2f06fae96fabefeba0a0e524bd09e2e368b172ae2389bb5bb78c

  • SHA512

    9d8914560edd9ac488d7d4daed4f6a62ab151df6568722e1bdd6526e936a5dce9c0a20e7055b43d441ce14dd5a7659c53e2c50b4aa99cf249f9256b1315e30a0

  Score

  10^/10

  redlinejn28d1infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    setup/Setup-Crack.exe

  • Size

    398.8MB

  • MD5

    b0fa60eeeb4a0cc8ac5ce244b393b131

  • SHA1

    399d046eb6a62e5c63e347eb6873797d66638d2f

  • SHA256

    e928aff9983da3f7cd3b216d91e9d239115755aa657f7526434a021a1fcbcd47

  • SHA512

    60f216eab6e7f2e6ab758f08fa3c79fd76c422dd7b389838f7916af87037b48b6965ab6fd17b98f4e8e50b93d933e6d12e1155732d4c321829b8c34644de0f92

  Score

  10^/10

  recordbreakerevasionstealertrojan

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4