Extracted

• • Target

    4b32941cd92e048e6a2d16c6069edf62.exe.bin

  • Size

    3.0MB

  • MD5

    4b32941cd92e048e6a2d16c6069edf62

  • SHA1

    5d167b4588575ffbc7a06cd9fa22552dced38951

  • SHA256

    a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d

  • SHA512

    8b5c75642960991648fd18fb2c5421f8d082f0982a4b5950dd091547dc53943fccb287a404593fbb08282188c3c94d75e05c28f1a58f83a5b6559f34a516442e

  • SSDEEP

    98304:6fFbrdnYUGkQqOSlBk1G4QBeKW0wnpTX5OIX:6fFbhBMqOxFgW3nRr

  Score

  10^/10

  auroraevasionspywarestealertrojanredlineinfostealer

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Detects any file with a triage score of 10

    This file has been assigned a triage score of 10, indicating a high likelihood of malicious behavior.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2