Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc

  • Size

    514KB

  • MD5

    ad9443ce5e431e8295fd202f57cf1d6d

  • SHA1

    330ab81f8d5d8360f11e9e15f6829608c3ed666e

  • SHA256

    2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc

  • SHA512

    d6bfaf96f61d6055c4e368f22542ba85d8d9c77d652480195953db43eced505a7102d5b10d79842e76483f90b1bbfa22a0d2fd6d0a423166efc8c585c3f665fb

  • SSDEEP

    12288:NMrby90ooS9jGwyQikPj16mcXt3Q+snYfeplV3:GyOSTJj143Q7nmebh

  Score

  10^/10

  amadeyhealerredlinesmokeloaderlandebackdoordropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1

• • Target

    24b96bca469764debd638550bc2704add4701110cc7a691fae627e361d8188df

  • Size

    389KB

  • MD5

    ad9be100cf69828b8e7a7a836154d5e4

  • SHA1

    dbf0f2accdb22e674419d2c0abda7fbef534c3dd

  • SHA256

    24b96bca469764debd638550bc2704add4701110cc7a691fae627e361d8188df

  • SHA512

    0e13d0bc6bfffef4ee50fb62eb2168de8426761b4da0091c95eceb7cb1f461bf05f73677bc07ddf504e69e306a3848e148b22c9fc17eeb3a247647a96d7f0446

  • SSDEEP

    6144:KKy+bnr+Rp0yN90QEnI11PokWcnZNbQR5nfyQPLaW5F/tyKYuNcUNQfMFkkhgVRn:WMrdy90uTPTcty+dqMS/VRi1nm

  Score

  10^/10

  healerredlinenasadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral2

• • Target

    2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447

  • Size

    314KB

  • MD5

    a2e82df6d2a9597325d8523d3625b7c9

  • SHA1

    1a5bf994f2bc9c0cd810e94776a3fc480f5d7f3b

  • SHA256

    2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447

  • SHA512

    1a89b7a438d12b21e4c2b2b9afbc348fcab3bfbce86b03ae49b001a5a184ed911cbf5f484da987c23957fec7afe9deebfc815215ef956bb3a8edf692a000eb10

  • SSDEEP

    6144:znnpI60nbM8uPZy3+8KIDx7uVKBrC27XXJCWsgg5DeQhNM9PXHS:zn+60nbnuK7I+rC0XX4gg5CQhqHS

  Score

  10^/10

  redline5637482599discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad

  • Size

    1.0MB

  • MD5

    aa56dc80d4e82ae017ce150cf8fa48cc

  • SHA1

    2a7ee36a1296e0438ef0e7a9ab41d8ff03496ec4

  • SHA256

    2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad

  • SHA512

    ce4c8441785c866d0bc9ab8a5c23bba8815fd8a1e30b9ab10ec6a36c6aaba2ebf70bf3c53a9515a52402014daf6e2b25542397fc498bb9a12ad11ee602769daf

  • SSDEEP

    24576:XyaHBh7s7f2+6EFDn3Q521V2AJ56SANT0kAZJzgc:iahwfsEd3F1sAJ565gke

  Score

  10^/10

  healerredlinemashadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral5

• • Target

    30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a

  • Size

    514KB

  • MD5

    a5906f38456848691daa7ad90e16383b

  • SHA1

    5eed856722109411b99eb607e5bbe4f4dc1537d8

  • SHA256

    30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a

  • SHA512

    ab8d1c01d7de39c82df4db1f704c0ae70d907c32dbf96bf9482d08ff4de06c7afb0636ba770b67b34af76fa848b6391b3b97a9aa6fa09bd993033b691b2c114c

  • SSDEEP

    12288:QMrZy90Xngq0rDJXt+/xLRjDd2zMpoCGmhF631xFKrn+CjYd:Zy60Pq/xFAwFGNFxFw+4k

  Score

  10^/10

  amadeyhealerredlinesmokeloaderkrastbackdoordropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral6

• • Target

    45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566

  • Size

    514KB

  • MD5

    a3b12999051bccd12021b96b6f86c928

  • SHA1

    d8fa4600a37079cabc0b61744970a0e1efaeb502

  • SHA256

    45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566

  • SHA512

    d795296547eefe35537e545f47a5b3bfb2a2cbc298c0ec422a62fd888fab370685b2102c4ee289ad8cc34e30f97dd616ec53e8cce3682d711ab28c5504a933b4

  • SSDEEP

    12288:kMrPy90Ptd6fvSMfJOjUlYm3Yw+uMNdwmD+gV3:DyTfqMfJOjQY2z+dwmD7

  Score

  10^/10

  amadeyhealerredlinesmokeloaderlandebackdoordropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral7

• • Target

    4daea23a41245608877f956cf37370e6533344758835349d21470fee22792f5a

  • Size

    307KB

  • MD5

    a9938a8bf2e4c5465b0c1f8d94199778

  • SHA1

    21a10d69514111047d789e5fabe472a9cb8b190f

  • SHA256

    4daea23a41245608877f956cf37370e6533344758835349d21470fee22792f5a

  • SHA512

    5404f81f3dae9f4c5192c18448aa15f90ff15e5823d6f971cafb3670d301f620c0928ed02bec680fedb7213b631d7e72e1748e097a0c477fa73df7c430f320f2

  • SSDEEP

    6144:KLy+bnr+lp0yN90QEv5F5OYc1u31g4TByxV7KJytDAUYss:dMrZy90Pxc1u31TTExV7KEt0UYss

  Score

  10^/10

  healerredlinedumuddropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral8

• • Target

    6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d

  • Size

    390KB

  • MD5

    a6f8f7131f6c47621b2e965cd6b6c981

  • SHA1

    327a8177a15d3a0838e98aa40ea5a8a46c655d95

  • SHA256

    6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d

  • SHA512

    d2b98015331f39aefb690df721fc0a0696dd17a621828cf729efca2cde927a8e603e5f88df50414d46020df7a52b49470df60cd7eb08a0ca9301a6ba50d00b3f

  • SSDEEP

    6144:KSy+bnr+Sp0yN90QE3zx3tQ3dNyVO12a/QNe9EOgqOLjBavFo4:mMr2y90pV3tQVo0QCaFma4

  Score

  10^/10

  amadeyhealerredlinenasadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral9

• • Target

    72a27ce3ad4f2daa863374d24914b9bdd41f5b34e08b440b9988fd847de7a3a5

  • Size

    389KB

  • MD5

    aa413f00a634a54138763909ad2d91fd

  • SHA1

    1878f20db3f565f33a3e719132e7c1a26169a938

  • SHA256

    72a27ce3ad4f2daa863374d24914b9bdd41f5b34e08b440b9988fd847de7a3a5

  • SHA512

    1e87efeb14401efd75d2e76423e750a0dd78e70f579c62a5a876e046300674dddde54ff450f06dfad4c95ae85e8d96f0f8199b1222cc206912b8d1aaa4567a5e

  • SSDEEP

    12288:tMrKy90lN9Rx8Rh/VCUR3OFegBYCRCThPL:vykFx8RhVCUB+9zuL

  Score

  10^/10

  amadeyhealerredlinenewsdropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral10

• • Target

    7ba9a3982314fb26523fd5988b2b520e3a32094566503b3706d39e88d9a9b35d

  • Size

    309KB

  • MD5

    a8738037b8124a9ad50d2479fa535762

  • SHA1

    3d7c656a7fe926fbf6c6a8d860b5524c0d1c1afb

  • SHA256

    7ba9a3982314fb26523fd5988b2b520e3a32094566503b3706d39e88d9a9b35d

  • SHA512

    1a8354d7e3941de59fdf8692c9473f1bd3b837c81e892909ce3641a5dc63fe52cc6854c11ebe26c57ec2c1eaf5add870ef3ef616b8b8d870a9676755c3668c23

  • SSDEEP

    6144:KTy+bnr+Sp0yN90QEV5F5OYc1u31g4TByk8zYHwl0UV8Mj:ZMrSy90Nxc1u31TTEk8xj

  Score

  10^/10

  healerredlinemihandropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral11

• • Target

    7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc

  • Size

    332KB

  • MD5

    b00adcc86618a8f28690451ebc279d6d

  • SHA1

    c7bdbc58ba0151095793c5d57183060eaefed14f

  • SHA256

    7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc

  • SHA512

    71a756e6328b3b226e8c52a8d3a831253b1221b1934cac2951d55c704c1c00153d9cc55bdf44380f21e82bf19d5a39bffc83154f33150c45a748cb4eaf6b56f6

  • SSDEEP

    6144:klZwB/LgLN340nTaDpOU7riHRkyghGiypL8yFxCFXTAXDREodP+0Xp:knhLN340nTP+yg0iylxxCFUGodW0Xp

  Score

  10^/10

  redline5345987420discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral12behavioral13

• • Target

    8a74314c35a7a341a4dec6d70e0d6801d49282a77f6ca44fee133e1d3ae7b45a

  • Size

    12.3MB

  • MD5

    a1e5c187755b1d1f6ecd92de6a1ee13d

  • SHA1

    b809713035e9e0451f7ab7e7b8f29b2c8e44dff5

  • SHA256

    8a74314c35a7a341a4dec6d70e0d6801d49282a77f6ca44fee133e1d3ae7b45a

  • SHA512

    c6e484d4668cd78d67b5ba5f65ab4639c2c03906e8585388aba521ec0ec062f9ea24109f174e9c4805c33230b5162a40ffcc65095f68d6baa14ef6b69490ecf0

  • SSDEEP

    196608:tUSP+yQZ55mfaEsVpxlTCUmT3p84YcgYp6OfPe1VyW4PTPJetC93t:tFw/41sVpTTC89PYgmPe1VSrPoC

  Score

  7^/10

  persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral14

• • Target

    ae6ddd393a98c003c8da6717e815e71c83f5a3b75783ce55e2793d35c51a9ad7

  • Size

    307KB

  • MD5

    a2ee8b5bb221af85a82fdb873d58d8e8

  • SHA1

    9e3456c33ad34ac4c394a031e6fd2e03a37503eb

  • SHA256

    ae6ddd393a98c003c8da6717e815e71c83f5a3b75783ce55e2793d35c51a9ad7

  • SHA512

    f52c8ab86819dafeae654e56cabf9157b1cb8f50098134dc4821edb8051bb739c5d1fe9f7b2fda560e028c3158065cd1ebb607e80a81a2d2ea41483d7f1fbca9

  • SSDEEP

    6144:KDy+bnr+Ugp0yN90QEX5F5OYc1u31g4TByS8EvbNk3yReoWkD:pMr3y90nxc1u31TTES8kk3p+D

  Score

  10^/10

  healerredlinedumuddropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral15

• • Target

    b2402bf5ca4c67871f6519e689231078532c147c35500668d062dec52e27e9fa

  • Size

    919KB

  • MD5

    aa26cccde046b0e54b832825a5756c35

  • SHA1

    f5c538220421870979edb4d93fdf8b02a4d0ecbc

  • SHA256

    b2402bf5ca4c67871f6519e689231078532c147c35500668d062dec52e27e9fa

  • SHA512

    60ace7d38dccf257e75c6e369355975b84757c127f93afecd6e58f4316bd7f1d13cf55f7d4264d6928e37f62a37d838f9b044567ea49f8bd27eec9511130a290

  • SSDEEP

    24576:IyAXaONmQk2uEBNOAaIGqgK1wjH9AxXChzyvp:PAr+RpItggoH9ARC4

  Score

  10^/10

  healerredlinelampdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral16

• • Target

    c39e49cedba79cf37944568e6b8975f59cf50c3ee02bad2cb56a9047b12fcee5

  • Size

    2.3MB

  • MD5

    a4fb9883ee8a8beb10c262b023906548

  • SHA1

    b332a89c7ab5de8e522f00cec3df72fb251e3ee9

  • SHA256

    c39e49cedba79cf37944568e6b8975f59cf50c3ee02bad2cb56a9047b12fcee5

  • SHA512

    9b13e63c323cdc49c48ded53ae80d9249545f8ad8630c0c2613cc48619bf7df669e76e15b6f255a1fc19ebc2a562dbcd03350b90dc90b15ea07405a45dfc5014

  • SSDEEP

    49152:AdeZsBDZfkum6kQgZxV0+qU9NOqbc5alaZVQ9ViNiv5DNwRFCrKB:ASMDk+cxV0+HbFcogZVQ9ViNiv5BwWg

  Score

  7^/10

  upx

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral17behavioral18

• • Target

    cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc

  • Size

    1.6MB

  • MD5

    aed3e716f608104e2440f5a872c969de

  • SHA1

    07bd20370b5dfebd101d421c64d040163aab20fc

  • SHA256

    cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc

  • SHA512

    80b1c179f57468ff121a0909e7e6940af32122e2086754329463c9c1877ea6e2cd4cfd0eccfe3f31b830a5d51fec6ceaacbd9e6c8eb6254cd734b0c4cdf00b5b

  • SSDEEP

    24576:fyl8gNcSnpEaZYaoMZ7R9DkPAjuhhqT5zoCVQcx/e1jTfIHBx8sEwZZl7:qHDVq0NZkPmKh8zoCVQt1/Inxz

  Score

  10^/10

  healerredlinemashadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral19

• • Target

    cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e

  • Size

    390KB

  • MD5

    ac4ef0a8163aa70cb3fb5a2c03402872

  • SHA1

    1f1ce96331c7c08e874f90e466a2617aa1295cfe

  • SHA256

    cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e

  • SHA512

    65e603525a657b938a3a0bef0faae91a787e00c8f28670e3113090340c8f982291e01455756e46b5e4abca68cc8598d8887f8b30c984b444f03b18a102c44e54

  • SSDEEP

    6144:KYy+bnr+Vp0yN90QEjJh/9hdzrnZ9YgDCV4ZfWb33aY3sJ41IwTSU3VqAtGay:8Mr9y90RblfzPtDCV4tyHsJh5AtGay

  Score

  10^/10

  amadeyhealerredlinelandedropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral20

• • Target

    dfa156ac28a140cde5b62ac7d594d1000da526091fd584c8e8caa96c692a5bff

  • Size

    862KB

  • MD5

    a85e4b8403f70f8c8c2a4694b484c3a8

  • SHA1

    ee614a34528cda5db2c436bbc77247c3fe213f60

  • SHA256

    dfa156ac28a140cde5b62ac7d594d1000da526091fd584c8e8caa96c692a5bff

  • SHA512

    457c453516d49626c8f0e5e9a446962314e44c1cfa8ae5b50f0fe344590ceb2a20f53936c3d6a6aff9e0379bbe8e0b9afdb3ec994ce1ad0980620919f29b5157

  • SSDEEP

    24576:5yRfeUF4xX+YYKqx+QgmUpqWngJeXUXDH7:ssUF4xXPY5gmRVJeX

  Score

  10^/10

  healerredlinekiradropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral21

• • Target

    f25337a343c26cdecd99eb7f095938fd24fb233463a8af3fa69acc5201eed956

  • Size

    435KB

  • MD5

    a76aada563b5fff5cf81824d40e87c25

  • SHA1

    b6c50c7d69b765a396e3995642cd3c82ed9eb370

  • SHA256

    f25337a343c26cdecd99eb7f095938fd24fb233463a8af3fa69acc5201eed956

  • SHA512

    093e3da142ee67a4da1c8f352460e5d90e9565ec60855285a19eb6e2c2f85d8b8ec22e0b5f46194222954ffeb19e1a8451f9d364c8869f1ef8050decc7154a56

  • SSDEEP

    6144:KGy+bnr+2p0yN90QERSilWQs1fiFwqQdcKrObo6czcJVDQvY6iflPOxpJOrtND4h:CMruy90HSil5s16yMbl+xHslOpMzKL1

  Score

  10^/10

  healerredlinecrazymuhadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral22

• • Target

    f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616

  • Size

    490KB

  • MD5

    a9b440ad0e7d76d9fa2ec485fa53eeba

  • SHA1

    179dcad63a03197776e3b9ee4354dbfa413f7528

  • SHA256

    f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616

  • SHA512

    bbdbfdf856719da627de9c70324edfeec3e2d91d32550c12fd2923302456da68768618f45788bc68e71d48de3f30e731181b9a69139624a70bf936a8a7de3a15

  • SSDEEP

    12288:quFz06FWD5fReUOLoFCaK40dC3l8qjNG8AR:qr+WVJeVLeK4PljJA

  Score

  10^/10

  redlineinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  behavioral23behavioral24