Extracted

Extracted

• • Target

    New Order PO_O8475980U09_Inquiry,pdf.exe

  • Size

    944KB

  • MD5

    13c7674b5ddf04d0c1ff4c44b12aa4d4

  • SHA1

    2d46412c7a2046c27b6549a31ad3dd9bf9a0935d

  • SHA256

    d3e83ecbfc6ead31c132b85910c6dd0c7a0e5bb343231a289cdc4203fbd9d6ad

  • SHA512

    2da740d5fdcdc49b9985bff25e2fdb187c9fb1545aaccccc895af46bb25a68b7f6966305bb07bf2340da0f223e364f250779d6ccc7d24273136eda141437a665

  • SSDEEP

    24576:zu6J33O0c+JY5UZ+XC0kGso6FaPAe2tQlvJWY:du0c++OCvkGs9FaPAeUY

  Score

  10^/10

  redlinexwormsuccessdiscoveryinfostealerratspywaretrojan

  • Detect Xworm Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2