Extracted

Extracted

• • Target
    0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe
  • Size 1.3MB
  • SHA256 0dea9964c6e2ad110ad9a26a2e25417afa7b2ed990362faa746fa81cb8a303cd
  • MD5 97f688358552bb8b81f51984f01b1897
  • SHA1 3ffb14da794c7e50f1cb1b2efa757eb0291e98d8
  • SHA512 a770646301b98fb45a73b2f20bbcb64f0c82aaecf43b9c4ffc7da63b66a907ef305a8724c5a4d5c636e05dcf2634f85b7abf0356899e28962ce63d1489622320
  • SSDEEP 24576:02CeZswR8wmEYzYUipSL72MjzdkICyasS3Ckc:02CsR8VohDsSSk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1707evasioninfostealerspywarestealerupx

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2