Extracted

• • Target

    298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a

  • Size

    2.5MB

  • MD5

    e8c93855d5b68012ea54fe097f37795a

  • SHA1

    e28379253878db94935cce1bd40e1aa622cdb818

  • SHA256

    298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a

  • SHA512

    e73aafdd818d89da6fbd5275cd2812992504588260caa40fe0313238eb4535b70311e3dd631db33d8abdac575d20010131dabc52501edbb0b43bfa5ff50e70f2

  • SSDEEP

    24576:F5UtB8YsPmYAYH3tlHCqMxJdIKH0X0ebqcyRo4N8fVxL7Wl3RuQ55313M:FyBrsXWAqpo4N8fVxul3O

  Score

  10^/10

  redlinexmrigevasioninfostealerminerspywareupxvmprotect

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2