Extracted

Extracted

• • Target

    3492109e6402567ad87451c72a554d3f112b5f59f3fb97e84082a767c2c76108.exe

  • Size

    384KB

  • MD5

    2ff5a03dff94e3d9cb079b4da0e57cf5

  • SHA1

    d6483a3b778de602ba2c5657ca8efa2a0b75e3de

  • SHA256

    3492109e6402567ad87451c72a554d3f112b5f59f3fb97e84082a767c2c76108

  • SHA512

    34cd550664d44cb43d49ca060fe02f59cf19e0555adfe0f188b4f0877e6408b09ec5087ed606e0c7e7b39ec1d10f8305268337048b73bf36e9d67b6d64960f41

  • SSDEEP

    6144:++pLw3TFfhAvLp2z62Dpl+X9Z+nD0nYwL6Q9HL6QGI7:BpLITFaKtuX9QnDmjj9rjGI

  Score

  10^/10

  arkeiredline03252020defaultaspackv2discoveryinfostealerstealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2