Extracted

Extracted

• • Target
    tmp
  • Size 18.4MB
  • SHA256 6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4
  • MD5 464502cbaae7b9ed1cd6da844d38ba86
  • SHA1 30dd42539cbfad04564f9db45ca40f2b9e81546c
  • SHA512 e74b45702eeaca95bc6c9f2aeea8a5958a425dc1f45ecfb127e286a39eb668243b41e56c705ae5fe7a72ff1ab691948adf29ddd6de18509421fa415647a36b59
  • SSDEEP 98304:2pgc9WBd2/ojIbrK51bnqvMwqwWhWznbdyxDDFC4B14d+iXLfg0rf2a33OXA7zTg:2pgnBkbYEMUWIzbdyxDDFCXpZU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  arrowratredline@noxycloudclientinfostealerratpersistence

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2