Extracted

Extracted

• • Target
    2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe
  • Size 2.6MB
  • SHA256 2ba224dabae18b11854ad87608470a7437a8faa9fd8955fb5dffc583e4b0495c
  • MD5 82757f4f01574a3254e6863ebe8f6a9b
  • SHA1 94ef694de9235360d4aa906b8473abfb754c404c
  • SHA512 7fa490944dd48bef1d119fad0cc1957281be663ea3f436e4ea44330001dcbcf1b61976a611220500b6a23de195a10489918b315bf1716a464a8d6f9209a31295
  • SSDEEP 24576:yxyzod8VRu+BRIWDhY8YflYCcP2KrMV+dheGiUe09s91ETGLnO4LJYiqLfMOl3Rb:y4zod8VR1BRIWLTi2kET2rLJYiqFl3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1707@maytee_oevasioninfostealerpersistencespywarestealerupx

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2