File name:

RedLine Stealer Cracked.rar

Full analysis: https://app.any.run/tasks/17476558-f8b0-44f2-a445-4cc35ff77ae0
Verdict: Malicious activity
Analysis date: May 17, 2025, 00:36:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
netreactor
xor-url
generic
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

4F0205E869CD5E12CD102A210443938C

SHA1:

0FB7A0EA87E66D067BA159743B9363CB55F27118

SHA256:

61974B843AE371E0472ABF494817311E209D1AD9D01505537B7A58A330E19DDA

SSDEEP:

98304:MEAAGglfBZhyA8jI2yFlM3cOy01MUnLD5QeBSN0Fs4FdpS4It/APNsRG9dXJJuH8:Nap

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7368)

    • XORed URL has been found (YARA)

      • RedLine.MainPanel-cracked.exe (PID: 7668)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7368)
      • RedLine.MainPanel-cracked.exe (PID: 7668)

    • There is functionality for taking screenshot (YARA)

      • RedLine.MainPanel-cracked.exe (PID: 7668)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7368)

    • Checks supported languages

      • RedLine.MainPanel-cracked.exe (PID: 7668)

    • Reads the computer name

      • RedLine.MainPanel-cracked.exe (PID: 7668)

    • Reads the machine GUID from the registry

      • RedLine.MainPanel-cracked.exe (PID: 7668)

    • .NET Reactor protector has been detected

      • RedLine.MainPanel-cracked.exe (PID: 7668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(7668) RedLine.MainPanel-cracked.exe
Decrypted-URLs (1)http://ip-api.com/line/?fields=hostingM~
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 24609
UncompressedSize: 34304
OperatingSystem: Win32
ArchivedFileName: RedLine Stealer Cracked/Libraries/builder.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #XOR-URL redline.mainpanel-cracked.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7368"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RedLine Stealer Cracked.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7668"C:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\RedLine.MainPanel-cracked.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\RedLine.MainPanel-cracked.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RedLinePanel
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7368.2180\redline stealer cracked\redline.mainpanel-cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
xor-url
(PID) Process(7668) RedLine.MainPanel-cracked.exe
Decrypted-URLs (1)http://ip-api.com/line/?fields=hostingM~
8092C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 887
Read events
3 879
Write events
8
Delete events
0

Modification events

(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RedLine Stealer Cracked.rar
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
14
Suspicious files
7
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\GuiLib.dllexecutable
MD5:EAF9C55793CD26F133708714ED3A5397
SHA256:87CFC70BEC2D2A37BCD5D46F9E6F0051F82E015FF96E8F2BC2D81B85F2632F15
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\links.txttext
MD5:7E0B0F449C419BC5DCE0A9AE1920C00C
SHA256:2CA989920E2CD5C250BE6FB5E0EF82EE45A77F2147E91D736562C110B5EC372E
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.Mdb.pdbbinary
MD5:0BA762B6B5FBDA000E51D66722A3BB2C
SHA256:D18EB89421D50F079291B78783408CEE4BAB6810E4C5A4B191849265BDD5BA7C
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Bunifu_UI_v1.52.dllexecutable
MD5:5ECA94D909F1BA4C5F3E35AC65A49076
SHA256:DE0E530D46C803D85B8AEB6D18816F1B09CB3DAFEFB5E19FDFA15C9F41E0F474
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.Pdb.pdbbinary
MD5:8E07476DB3813903E596B669D3744855
SHA256:AA6469974D04CBA872F86E6598771663BB8721D43A4A0A2A44CF3E2CD2F1E646
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.pdbbinary
MD5:C0A69F1B0C50D4F133CD0B278AC2A531
SHA256:A4F79C99D8923BD6C30EFAFA39363C18BABE95F6609BBAD242BCA44342CCC7BB
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.Pdb.dllexecutable
MD5:6CD3ED3DB95D4671B866411DB4950853
SHA256:D67EBD49241041E6B6191703A90D89E68D4465ADCE02C595218B867DF34581A3
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\builder.pdbbinary
MD5:418DC008EF956465E179EC29D3C3C245
SHA256:8C7E21B37540211D56C5FDBB7E731655A96945AA83F2988E33D5ADB8AA7C8DF1
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.dllexecutable
MD5:7546ACEBC5A5213DEE2A5ED18D7EBC6C
SHA256:7744C9C84C28033BC3606F4DFCE2ADCD6F632E2BE7827893C3E2257100F1CF9E
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\stub.exeexecutable
MD5:C2F7222E591A9D587C20486FE97AE551
SHA256:3F63F47C4D764D332F13FAF328F73F7A205E3422D89AFA8ACD4514912A556037
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7920
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7920
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4024
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.128
  • 20.190.159.73
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.130
  • 40.126.31.1
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RedLine Stealer Cracked.rar