Extracted

Extracted

• • Target
    1EB3BEFDF4978A7899E2B7CA8297D0A3ABF2B1FCBA64E.exe
  • Size 2.3MB
  • SHA256 1eb3befdf4978a7899e2b7ca8297d0a3abf2b1fcba64e761abbff8aebace0818
  • MD5 87c987194120a2c704cd8a047fce9b79
  • SHA1 d2daa8e53292e9f3d47236cebfd5767aba69ee57
  • SHA512 59009bd835e31f50602d31719c3838a5998da10b0265d4636833c76ec2c1b28214522da07ecca5f5506484a254e0153b65368092ff3a52d3898a7f7114cab567
  • SSDEEP 49152:ldPYWkHTbhMidR1RiqtZxwylS8RjJWwOp9wE:ldPYWkHTbhMidR1RiqtAylSjp9D
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1707evasioninfostealerpersistencespywarestealerupx

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2