Extracted

• • Target
    0775e8cd43f856f12da4aa77fcef506b45c1da669bd37a93ddcb1a1a1f1d4aa3
  • Size 2.6MB
  • SHA256 0775e8cd43f856f12da4aa77fcef506b45c1da669bd37a93ddcb1a1a1f1d4aa3
  • MD5 8c2df7e94aecf922bac33303693edc40
  • SHA1 543f4c3d3fde073917bb0a930bfca91ac84b20cd
  • SHA512 25b27c07e77c3a585d696481fe7c5e51a90f597c8c2273521718809c7dc2cd31f74c93f0f9b678048edaea6414f65149f15af9a9b27490a85d730040c6aa5dfd
  • SSDEEP 49152:kDjlabwz922E1G8hl3INPHfdBcZiyuNFBAkpVOZgyo2upnA4yOQC2:0qwE2E1G4ONHdBcMyuNFBAkHOZNoBA4m
  • TLSH
    T168C5120AE7E404F8E1B7F63889268916F77B3C5A4771968F12AD121A1F77390CD3A721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheatdefense_evasiondiscoveryexecutionredlinexmriginfostealerminerpersistenceadwarespyware

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • RedLine payload

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2