Extracted

Extracted

• • Target
    ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe
  • Size 492KB
  • SHA256 ed28743bfc1a8f95a95e5c6fee5597d6961e497413d8e9b3544588ae7484f3f4
  • MD5 81d3017db518b0b252fbc291a5c7d992
  • SHA1 e05a2679511cc7d307c79b3170f9e8baaf87babc
  • SHA512 e9380fad8c17727c692c4c661e473be836010d4d456af7a8bb2999153a3c26735e080fa6274a62d2634b0510ecfe4eb4e656234eca2f4a9a03575d959a9cc6bb
  • SSDEEP 12288:gOfPr+8CHzhgAOt0AcfAWV5CRbdjNA98wl:hfz+NThghUAWVMRRjNJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline@cham1ngdiscoveryinfostealerspywarestealercolibribuild1loaderupx

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2