Overview

overview

10

Static

static

1

setup/AISe...ck.exe

windows7-x64

10

setup/AISe...ck.exe

windows10-2004-x64

10

setup/Pre-...up.exe

windows7-x64

10

setup/Pre-...up.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8aba7f1ddcc3aee078384b9ce669b079363f752

  • Size

    2.5MB

  • Sample

    241111-fcsgjatcrc

  • MD5

    c71a2a91e5f839bb780148cda726fae2

  • SHA1

    e8aba7f1ddcc3aee078384b9ce669b079363f752

  • SHA256

    bc216a74104d2769435504e1ebcb968824510db1ce1a761052625bd8beb148dd

  • SHA512

    0f49cb1259c0fb34a9e4a749206927d8934070f31726a719fd67fe37b62019f1d1bb1a9678ac3ae9e12dcc956fc7e33d196881e39b0cf3f3dfadaa583646c0ea

  • SSDEEP

    49152:bQl394dwWOK5t3wEQliWGdd5eX6PVpT7HDfPUXCbmJNN2K37nW4tjKQGw:bQlydwDK56Bs9/m0VpT7HrMXdMKTntOe

Score
10/10
redlinevidar1281leo5discoveryinfostealerstealer

Malware Config

Extracted

Family

redline

Botnet

leo5

C2

cenyeyalory.xyz:80

kaiaiannial.xyz:80

viasanainah.xyz:80

xtelstasiup.xyz:80
Attributes
  • auth_value

    be820120fdc25e4fee4cd33b669b3e2c

Extracted

Family

vidar

Version

52.1

Botnet

1281

C2

https://t.me/verstappenf1r

Attributes
  • profile_id

    1281

Targets

    • Target

      setup/AISetup-Crack.exe

    • Size

      346.0MB

    • MD5

      90ef61d984f55737294d927f72496891

    • SHA1

      565881a9d1583474f6323b9fa5abb03055264965

    • SHA256

      d0c043510a0cb5f5c3d0812f2e7f961be85f538ef7f8ed1be70c85e0cf20f3a6

    • SHA512

      608148ee5e611bb65931f64d86fc2ae8f432dc1fa91763b3680ea5f46f44f1000d5a24e7cc7fd85737729ad64f2bb88f07e537a4d641e26220089829fccd057e

    • SSDEEP

      49152:fe6AUzdMrocQ9CqgcnaRH5uj/VTTbeuOd86J4:fe6AedMrocQ9Cqgco5q/Vq59J

    Score
    10/10
    redlineleo5discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      setup/Pre-Activated-Setup.exe

    • Size

      347.3MB

    • MD5

      6c61d27cdd0a9c8750a92021990fbc19

    • SHA1

      7f6fdf0db122195d4737f5ca85e292e0f10fbccd

    • SHA256

      8195c3e7fde033b97d9a99d642e841a4d78e4610a2e2867e303d8bd4baa6eac2

    • SHA512

      685a7bfb68072cb4f59c9137b6910f75da31401a6bbf915ddd2217400d367473b325b0c36f2705219363ebab9fcc8b0cbaed6839c2dcd403e1ee70eb31bd96f4

    • SSDEEP

      98304:gHh5kUQPPI8ZL/SbM7RjemXVY+PYfZbBVz08G+UuVMU:K2UQP7pemXV7MZbgjuV

    Score
    10/10
    vidar1281discoverystealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Vidar Stealer

      stealer

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks