Extracted

Extracted

• • Target

    data/vulkan-1.dll

  • Size

    894KB

  • MD5

    4b29603d5f208f805a5227fa1d6713cc

  • SHA1

    ef7c6478e26dd2c2f4fc4ecce0b7d710a9023f09

  • SHA256

    998280e73d8a5d62a25d335b291363d15f3746492ac3d5f4479549f9442c6b9e

  • SHA512

    f863571fd13aea9bbdd0d96ed671a6cd11f28a3a9677357317b6afc0c8990c23176c1ce68a645057cb2dc09d2fc5d93963b7578ae50aa3636d049b5a68584d31

  • SSDEEP

    12288:UQgtdWVrC+8eiZB25pL82ZWdAKT0Yo5KE1so3AJLLP:U1dWtNbBZWz6t1svtT

  Score

  3^/10
  behavioral1behavioral2

• • Target

    setup.exe

  • Size

    565.8MB

  • MD5

    b34cf82d7d10a1c8421ef3fe65e4de46

  • SHA1

    574c8dd9986952916786b03c0261230a933f3e9d

  • SHA256

    7e73c496079d96e4ccec427679b791518f25aaca20585a5d54f632064ff880ae

  • SHA512

    69fb1cb2e37c7b3321ff898aac936233521026834c07b92a7c8fa7885a363f5b2a6d6d455309435802f70827bc7ecb955ed9e4c7a8fdbcde212bc479748647ed

  • SSDEEP

    1536:8rae78zjORCDGwfdCSog01313fs5gG8m:kahKyd2n31E5d

  Score

  10^/10

  purecrypterdownloaderloaderpersistenceredline@fjiif563infostealer

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral3behavioral4