Extracted

Extracted

Extracted

• • Target
    4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e
  • Size 2.3MB
  • SHA256 4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e
  • MD5 aa25a6dbf0319ac7466e5e4c8b7ee4a3
  • SHA1 f5cfc23ae0d2785f5aae32a07eaf15f9cfc4ac24
  • SHA512 ccd6232ae5918110ef911fbd27de2619cc2a1cbf1b08029b4953166bdaaa2ba087d418726e612dc84afc803e1cc95229834e1b0c91696471b8b08e4c6ff080df
  • SSDEEP 49152:J84+V9pjc8VJiy7jHrpb3KPyT5cRIdesz1E:JEV9Rv7jLpjKKVGIdZ1E
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  arkeiredline11/13defaultошибкаdiscoveryinfostealerpersistencestealerupx

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Arkei family

    arkei

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2