Extracted

Extracted

• • Target

    1.msi

  • Size

    354.2MB

  • MD5

    3fec58a8814463d25e3c18eb95d4803f

  • SHA1

    d19f99436a9e3d97285802ee7ed755aad4f6187d

  • SHA256

    2e21637e26f39ce81a13107263f2e62e6e23b7d00466c77b98b2df3e06422121

  • SHA512

    5092c48418cecbee2f1e02383e64a826d96eacd0ada9878b85dcb44f56e1c22a083e65b1b7eab56e7831dc740ffa978d456b02d77264e1913dc3db7a2f73c824

  • SSDEEP

    98304:DpyS79tNaQiLb0icbxl+364Sp+364tgF:cSX09w

  Score

  10^/10

  redlineinginerudiscoveryinfostealerpersistenceprivilege_escalation

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Modifies file permissions

    discovery

  • Uses the VBS compiler for execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    URFT06GSBAWRP_001_PDF.exe

  • Size

    300.0MB

  • MD5

    464753cd8a6523de0fba921ce6846177

  • SHA1

    6b3b77af1129f9ad86acc31163d8450eacb4dbd3

  • SHA256

    3221a50204afcf59f4a836680d1e484903ac3aa389c2105d059efc51b8461092

  • SHA512

    589d0919ddf11d1e8e8eff15a0f78623742e5ab6b16e2b754f519f3bfc7912ccd6c43ad5ffe5c0e11c315f9835936b6b2039dc579527d50cb25333844b0876f2

  • SSDEEP

    3072:1iJZ3k2p8jrvVIYkwur2JMBZ6kINhCRFuaABOUEs64BRg40nOFblHTgr4:1OyRr9u1KJkZ6dIYBUeBRgOlWU

  Score

  10^/10

  asyncratvenom clientsdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral3behavioral4