Extracted

Extracted

• • Target

    Setup.exe

  • Size

    11.5MB

  • MD5

    4e575e624b5d4822a17e98958410c4f5

  • SHA1

    fe8b87a7ee4bed3f44e47e335a9759bba086c61a

  • SHA256

    2772daff384534e0455b023285c177210bc038749038f8a41bc74e71b035d516

  • SHA512

    a1da1c612d9769f36dea6c9e299806ef56c84e0d28cbf88ebc14642b578a14b359456a7707c087299f4f976b28361328394af5089270ed2e8c0321267067eb43

  • SSDEEP

    3072:+QyZ/mEHgQS7vDYafnPq/KAlTSskcdE/Zli3sI1Snq51YZAkiMJ/c7Er2lJhbJdK:+lZtHHSr/AldE/ZRA11Cc7EOJ7q

  Score

  10^/10

  redlinevidar754discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1