Extracted

Extracted

• • Target

    tmp

  • Size

    18.4MB

  • MD5

    464502cbaae7b9ed1cd6da844d38ba86

  • SHA1

    30dd42539cbfad04564f9db45ca40f2b9e81546c

  • SHA256

    6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4

  • SHA512

    e74b45702eeaca95bc6c9f2aeea8a5958a425dc1f45ecfb127e286a39eb668243b41e56c705ae5fe7a72ff1ab691948adf29ddd6de18509421fa415647a36b59

  • SSDEEP

    98304:2pgc9WBd2/ojIbrK51bnqvMwqwWhWznbdyxDDFC4B14d+iXLfg0rf2a33OXA7zTg:2pgnBkbYEMUWIzbdyxDDFCXpZU

  Score

  10^/10

  arrowratredline@noxycloudclientinfostealerratpersistence

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2