Extracted

• • Target

    409cd2191cd5207704f590ca05b3ecd94bfe086f09c4aa87422e4126f04cab14

  • Size

    2.4MB

  • MD5

    c1fe936433eb4be74eef3e7095f42d77

  • SHA1

    b997230735a2a033647425441f908cb906047523

  • SHA256

    409cd2191cd5207704f590ca05b3ecd94bfe086f09c4aa87422e4126f04cab14

  • SHA512

    e33c1fec65c97cd2c5dabeb460ef83e2102201d9d9cf1c2789b7dfa65e2bb6063b927612a7bfc7eff234fc70ee14802af4fe134b8abeb00c4f6fea2adda8e7a6

  • SSDEEP

    24576:cBqYYgYPXQh8RMpJRh9dM46/uN9X5koyLSAOtSL2SxgCl3RuQ55313V:cBmsIoyLSAOtSll3T

  Score

  10^/10

  redline@mnogokupurbolshoykarmanevasioninfostealerpersistencespywareupxvmprotect

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2