Extracted

• • Target

    Setup 2.exe

  • Size

    3.4MB

  • MD5

    fb430617074d580d39d5713abcfdc095

  • SHA1

    08d5d42d079a1b60c39225cb2933686d050edc1d

  • SHA256

    f4326903b6446139efb0ee5e3251ca95f1ada0963829deb1547df4c5b6930bf2

  • SHA512

    6df1dd5f8c42529e99fc93c93c4deb491d8f811819cdbed4c222da28254d35fe02f0792db2e6b59ff00538351d51f687e8a54f06f7a643bf973177c6aedd1b8c

  • SSDEEP

    98304:E52wmQdKG7qhlBQekY049suZMx8WDj09hKBNUhlbYY:Ep37wdkdXuZMCSKcByhll

  Score

  10^/10

  redlineinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    FiIе/Setup.exe

  • Size

    480KB

  • MD5

    701477f861bde9756d5fc3ace9d2f019

  • SHA1

    2e0f06df176b574cd8f629f8e0d32fdedc72dd20

  • SHA256

    48aa1381548b2590a3ae1d740852fdefdf51c46666ee2d86e50aeae66afbda60

  • SHA512

    97eb40e656f06fc06b0c7d52aae69c64464ee47a8d350e041fe6c7c90e35ed44b1d976bdbcb968c146beb44624224be62fa4a2b919e81ce7644b6c13f0b636c7

  • SSDEEP

    12288:cpdcHSyxPmq2i7PFMzPV2v207z4TSxf4sugsRBN3dMon:MdPypmH1VU20X4RmwMY

  Score

  10^/10

  vidarspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral3behavioral4