Extracted

Extracted

• • Target
    DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe
  • Size 1.2MB
  • SHA256 ddc401c77fcd4153860cc36056d6c4fc725910e38c09ea02031ebe354026564f
  • MD5 90fdd9656ae18d88f7e16bcd0541f67d
  • SHA1 ab5cc5b127592e2cfa15655ef49c3ca6d714e591
  • SHA512 061003999de45d5834a8e4a06fedea2e4156e61f62d336c46c3dd6079d05c6c0fe3c714b15443ecf794380809635c55473cfd6e6466a19185fb3f5d51c49a1bd
  • SSDEEP 24576:Y3GXkhfSiRYyYjta2A8UMLtd9QCVsTs6I9/Uv6M:Y3MkhfSQCAs6uM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinevidar1707@panamamenevasioninfostealerpersistencespywarestealerupx

  • Modifies security service

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2