Extracted

Extracted

• • Target
    file.exe
  • Size 1.3MB
  • SHA256 a7b698f479cb724c56e1125d93bbbaf21ca360aff063e822f7e6fae08dd9c33e
  • MD5 61cb5dc02f663fef9b2083aee8af911c
  • SHA1 4d1353d31d37089cf9bcff76d3aff45847310c56
  • SHA512 4766b82110ed049bab9a7176e7771f3c1ab8233d5568bb6e652e7e771b3e26bda4b2564944d46793d3ef293e43b2bf2e17a9bf0f2a832d7f769963f49da856b7
  • SSDEEP 24576:7Yp4qcQrd82UIiMh76FEh5h4MUqJAd4fp7qtWTKPHs+K:7RqzIHXFEh8almy
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar701inst2infostealerspywarestealerdiscovery

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2