Extracted

• • Target
    file.exe
  • Size 33.9MB
  • SHA256 7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a
  • MD5 6b1a870bc9aa0a5d88931278f4375f50
  • SHA1 9139a0817ef5a3c0f4e97e562c22b2bb878d981a
  • SHA512 64fdacf0ffad12cb132f28e553e09935ee5af0299aa6f4c488a3b09fdf8c8cd678044b97a35a8f9a6adcb3fe953d15b317aa30c960429961fb78bb63e743d1b5
  • SSDEEP 786432:Z2Xrb9TTfy3iK786wzkyBQFgzTUXeNw8m5lRmv:EXl+RBwXzTUX0w8mxmv
  • TLSH
    T109771256E2FD00E8E5BAC0B8C6575517E7B2345517309BEB52A48A692F33FE0AE3D310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  kilo3clickdiscoveryexecutiondonutloaderredlineinfostealerloaderspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2