Extracted

Extracted

• • Target
    D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe
  • Size 2.6MB
  • SHA256 d51b59d11c7ce7a34f7568b108f253a337c19b2cbfa8778f5f5bf7ab8d0a439b
  • MD5 92bcfad1bc78df4fee073b920875ab65
  • SHA1 e186d3ceb7c50ee5e0ce083b748c8ff66faefa5b
  • SHA512 6913e0e68c9bc890c5d68bd62cd3148062a244e7dc907ffa5705d9a9ff69d4a08aee7d56f7c7b5b4498c5b20ecad3c146fb52de7c5c8f9e5067e02968786a9ab
  • SSDEEP 24576:9TyIlYnyLmB3h9HGe+VYlYrwqhruvMkVdbO1EpI3ktdtBUMCNcIVYL/8lQKl3Ruh:RyIlYnemb9HFlS/udtB3CNcIVYwl3U
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1707evasioninfostealerspywarestealerupx

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2