Extracted

• • Target

    INVOICE_.EXE

  • Size

    1.0MB

  • MD5

    d01af08af1935589ed6974734f764f5a

  • SHA1

    75d31c4f55e98d500abac8a5ab304a559283e9e5

  • SHA256

    f7c5b46a0b80bd17ec7af21458bbc2cd7c0873f81218475013b50953a72a887f

  • SHA512

    958a8efa7867077c7dbf66b21090d9186d4757e9f71895ed04ea48d6ba0f79b1a2d7789710921a15f0cdc5d83bf1d5d10260445982555e58bf96101aed026e7c

  • SSDEEP

    24576:vXOGXrxgZIYdflxH28iLJ6fLOscta6VQz5CZporN2OtOzy:vX3rx43g8iLJkLOjs6VkCZ2x1

  Score

  10^/10

  blustealerstealerredlineinfostealerspyware

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2