Extracted

Extracted

Extracted

• • Target

    4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e

  • Size

    2.3MB

  • MD5

    aa25a6dbf0319ac7466e5e4c8b7ee4a3

  • SHA1

    f5cfc23ae0d2785f5aae32a07eaf15f9cfc4ac24

  • SHA256

    4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e

  • SHA512

    ccd6232ae5918110ef911fbd27de2619cc2a1cbf1b08029b4953166bdaaa2ba087d418726e612dc84afc803e1cc95229834e1b0c91696471b8b08e4c6ff080df

  • SSDEEP

    49152:J84+V9pjc8VJiy7jHrpb3KPyT5cRIdesz1E:JEV9Rv7jLpjKKVGIdZ1E

  Score

  10^/10

  arkeiredline11/13defaultошибкаdiscoveryinfostealerpersistencestealerupx

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Arkei family

    arkei

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2