Extracted

Extracted

• • Target

    Panel.exe

  • Size

    9.3MB

  • MD5

    f4e19b67ef27af1434151a512860574e

  • SHA1

    56304fc2729974124341e697f3b21c84a8dd242a

  • SHA256

    c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a

  • SHA512

    a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77

  • SSDEEP

    196608:mJQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHidVI1SM52n3iWuUZ/c1sxXoP3p:mJQaPHrQqXs140qMhu8369sV+HLz9SKI

  Score

  10^/10

  redlineinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1

• • Target

    Patch.exe

  • Size

    174KB

  • MD5

    9d976aa0b7b02302e0e89466040080d0

  • SHA1

    70c91eee4491050908bb74c5c00ff0f01efff7a3

  • SHA256

    3ec60ccea3fec48d3ea33c63d7d66ec1d3badb174963e8dffe8ce528473c6886

  • SHA512

    c8b1c3ff4a21baf629147271ce57b7762e692cf94fb430b10e0eab22c0833d7881b1a6724a08844abe0dc98a4f964ef1766edbbf7515bde365a4fc453b94dfcd

  • SSDEEP

    768:rgsY7T0sl+kKGUhk6P5p32E8yNQmskkGLbvio3ZzeuOl:Hli6r2mNt0GLzl3Zc

  Score

  10^/10

  arkeiredline1877defaultdiscoveryinfostealerspywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral2