Extracted

Extracted

• • Target
    FD4F3959ACEC139B27223A7D47CE8C5C00FF02E60D34E.exe
  • Size 1.1MB
  • SHA256 fd4f3959acec139b27223a7d47ce8c5c00ff02e60d34ea3c7a8d8d466c831f74
  • MD5 143a3be57fb57f16ae2a0021e4319610
  • SHA1 b9735efc5a694f03a370da8f0c5a8d62abd13e44
  • SHA512 b6202f8aec51e299586070fdc47b02eb3920657bfe15267f485c85f9cb02df4fb46f0bf9483d193a915e8a872aac9082e51c4f5ec3a2bf8a3abbe4f8fe471a25
  • SSDEEP 24576:NF6nYfYhG17OGfM3N6YYfGhKvIhNGBgl:NFbB+nl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1707evasioninfostealerpersistencespywarestealerupx

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2