Extracted

• • Target
    file.exe
  • Size 7.4MB
  • SHA256 8befc91b605e2dd3ee8917f6e4b2ab943ec7900d257b704955c2defc0328b4d8
  • MD5 5d177fea866310a509bd0e561d7dd304
  • SHA1 b913e728b0a52958eee420cc18506c4f8b9f34fc
  • SHA512 a698c64afa704bb4af217153be4f7f8231a8f012e6c8e0ed36254c505b86f1529b8ada069ceb4acce6ba91896fa2175620d8ee076c221c61c6bf56c936e3c792
  • SSDEEP 196608:k2u5XXcXzG1JRHGkwCNAalDGX5ICteEroxzlxZV3Gu5D4S26/CS3WBTMwC:AlX0zwJ7f9l+InErot14S262BZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinexmrigdark1discoveryinfostealerminerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2