Extracted

• • Target

    deflated-rufus_Installer.exe

  • Size

    2.6MB

  • MD5

    9814a046255e18128a7605b718efca93

  • SHA1

    5d83e5f3931720fce6ccb43186391f3114124679

  • SHA256

    047528fe2e0b207d93b51f21109eea05ece9bec290c8ddf22a09301bf262735a

  • SHA512

    bf2f9346bc2296542ae6818df770ad922034e40eb35928c513189edb81df52a7f6b8f53b0b645785902c8ed30f2f578a5361d8bb6ebb8883d5d5f794d3bb20f0

  • SSDEEP

    49152:3mJQWFAlO5SRY8mYzbNKrFtbrR4S2EypQ2QbQQ69cE:2HAOTYvYbDypQ2QbOF

  Score

  10^/10

  purecrypterredlinenewdiscoverydownloaderinfostealerloaderspywarestealer

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2