Extracted

• • Target
    69a3187a043ac79373ba583c77560bead7a8743c640b99e7f788164293768374
  • Size 3.2MB
  • SHA256 69a3187a043ac79373ba583c77560bead7a8743c640b99e7f788164293768374
  • MD5 89db9d50025e6a7f1425b5b13b5918d8
  • SHA1 f2f99f1804fbc5a382aec11926bf447943eaa944
  • SHA512 a58f3846e0d1dc5e48a4f9576fb1d124ddd2104783cec5689615862be408b8570f276d396764122c9ba34d001698a8e127b095ddc12bb84be7123dd204818b49
  • SSDEEP 98304:0qwG2E1G4ONHdBcMyuNFBAkHOZNoBA4yO1Q+l5ec:0qwG2aJqHd1xsN9R+n
  • TLSH
    T1D5F5121AE3E404F8E1B7F638CA178906E77B3C4A4771968F12AD125A1F77690CD3A721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdiscoveryexecutionredlinexmriginfostealermineradwarepersistencespyware

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • RedLine payload

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2