Extracted

• • Target
    08ddca87b625734e0028a89fd4ec7247
  • Size 98KB
  • SHA256 6da210965cd769856bbcb8bb501abf25c832f0f6a70e73240436629ce6362fa9
  • MD5 08ddca87b625734e0028a89fd4ec7247
  • SHA1 00f577cfd480bd7527122b4f3a96d1914ca6dd55
  • SHA512 d2aabdecd49c087fbf2a070d79d3e6523228451814d5462336459c1200c72cb065a87617b9bb47d28fd9ed4e8706500a978c52f800b0f6422438a6dbba3129ad
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinediscoveryinfostealerspywarestealersuricataupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • suricata: ET MALWARE Generic gate[.].php GET with minimal headers

    suricata

  • suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2