Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    6A42F7E5290BF7E40E1AA0C0E9CEDA098A612D6DDA9B7.exe

  • Size

    6.4MB

  • MD5

    207314269cf248438c64288dbd8dd84a

  • SHA1

    214e1ffe1fe5271e11308aceb4f5d03b89e607e0

  • SHA256

    6a42f7e5290bf7e40e1aa0c0e9ceda098a612d6dda9b7fa613e0c3a58b16b826

  • SHA512

    d675a42161d5308a66a74d76c0b8d275ee1d5ebbd23f779ee980b5f90443d5c7442eb0b921bcb0498d07f8b9cb3aab010652483f26737aaa77f8b212b60bb50f

  Score

  10^/10

  privateloaderredlinesocelarsvidar915v3user1aspackv2evasioninfostealerloadermainspywarestealertrojanonlyloggermedia18n

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • OnlyLogger payload

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2