Extracted

Extracted

• • Target
    file.exe
  • Size 289KB
  • SHA256 b86d6ea3ce0dc5838b25832e447df16bebe6d3da489401bee5b6f565cebea5b7
  • MD5 266fb6a054fec799abc7cf154fd65dc1
  • SHA1 d29b784e487b89cdf88e1c77ca326e5cd022f8f1
  • SHA512 39eabbe91cc452951dc09ce6c3acd739c1bfe7366987f4e9e0446f2687e1d49a60c6bc651c92a30cd12203a7361e96d0ec02809c37d011a679a7cd8166a8bc8d
  • SSDEEP 3072:4bRXvuRWabB6YixgeYy5cAyoqTnI36WBjzKzxKtfIqJIVY2KKEUVsy+vZpMf0Eiw:Hw2pAWQBjzMxWtWVY2pEUVT+vZpAzy+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1515lyla5.09.10discoveryinfostealerminerpersistencespywarestealervmprotect

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detectes Phoenix Miner Payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2