Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    2073e60238669378edde068984829664197b70d887e0b0a50fa4cbc5b60a673f

  • Size

    134KB

  • MD5

    19af66030d0dabbd36d2906899a7a1b8

  • SHA1

    84a40d96f95ceace89f5ad18bc7e7988c520772c

  • SHA256

    2073e60238669378edde068984829664197b70d887e0b0a50fa4cbc5b60a673f

  • SHA512

    f96638d275f39155eb8437a8d1302cca7dea5c487857f08a2335d91eb30b9333dd5fede86a8e5bbd7bd55f4881c76b1180d9056ae5c2a033eaa75e13597e4919

  • SSDEEP

    3072:oPzFghPAyW9Mhbf7OoT+3xTU4VwgWPoV2yem+Ej:YifWGbTlSTUjxyem+I

  Score

  10^/10

  redlinesystembcxmrig[ pro ]infostealerminerpersistencespywaretrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1