Extracted

Extracted

• • Target
    F020132F2F56D617A36B719DEC76ED9CC5A7CF9BF54DF.exe
  • Size 1.3MB
  • SHA256 f020132f2f56d617a36b719dec76ed9cc5a7cf9bf54df83083f788b0ac4301cb
  • MD5 7c91dd70edc82edbc989b92a3a6cc009
  • SHA1 47009fd3196b89bc0dfdae21390898b7f3fbc7a8
  • SHA512 38dc4d699ae6f28c473702ecace324202b96ef5eba54261558448a4c71fb5b02d2ae6e79182e94c95ce01a8689815eeb0de479ed63bb91f30020cfb34d1d5eaa
  • SSDEEP 24576:DmD0dU1Yqq2wDWh7W7vFq+qxnSYxYj744+PKMfEGdkoR6CosE824vW:Sq2Jg7vI+qxqcb6sEJ4vW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1707@iskeinevasioninfostealerspywarestealerupx

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2