Extracted

Extracted

• • Target
    3ec33396a0f7ef6b51ce517c9a9e8521.exe
  • Size 2.3MB
  • SHA256 a4a8506c8f2bc00ba1d6ef93780ee6de4072e988113474758a24b2bc88b8e708
  • MD5 3ec33396a0f7ef6b51ce517c9a9e8521
  • SHA1 5ceb0574c486274ad2b2da37831341a9afb654ba
  • SHA512 ddbcab73716af2009fc968052853c0d88d8b918cb3e35a241afdfe917811b71bdc9e6b6bd011f5e883f020cab07ca2b0c504df530e0294abc1a336eb134ae5a1
  • SSDEEP 24576:+wnUYsYufPXovM65v3YBtueCScwYRg7AkRsLoa7WPl3RuQ55313H:+wl2cwmg7AkRsEPl3Z
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1707infostealerspywarestealerevasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2