Extracted

Extracted

• • Target
    7499e5f2d7ec245e12681ce605fe493398f2c3df2a72cd683853ad1be2721fe5
  • Size 10.7MB
  • SHA256 7499e5f2d7ec245e12681ce605fe493398f2c3df2a72cd683853ad1be2721fe5
  • MD5 bd16d8f9613eba7a5766f2b1fcc5d3ce
  • SHA1 30e67d02b4d7b6f835457f26b3eb9c0db53692f5
  • SHA512 e67eea910ed4eb00c52a32b75c95c1cee0944dca4d2e58485a71fd454b21a5578c748c0cf615fa4dd9b8bd36080830c6fa57f07899289cdddefdf47548456feb
  • SSDEEP 196608:ZjrZ/EKtbW897G+x7eovq5XMP6PzFcx97WZHsoqEbRjMFbTntc:Z5/EK1Fdq1B7wgZHsoqEbpibTn
  • TLSH
    T18FB6124A63A401F9E4B78239C952C556E7B2BC155770978F07E04AAB3F273E09E3E721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  buildzzfffdiscoveryredlinestealcinfostealerpersistencepyinstallerstealeradwareransomwarespyware

  • Detects Stealc stealer Version 2

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • RedLine payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2