File name:

RedLine Stealer Cracked.rar

Full analysis: https://app.any.run/tasks/17476558-f8b0-44f2-a445-4cc35ff77ae0
Verdict: Malicious activity
Analysis date: May 17, 2025, 00:36:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
netreactor
xor-url
generic
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

4F0205E869CD5E12CD102A210443938C

SHA1:

0FB7A0EA87E66D067BA159743B9363CB55F27118

SHA256:

61974B843AE371E0472ABF494817311E209D1AD9D01505537B7A58A330E19DDA

SSDEEP:

98304:MEAAGglfBZhyA8jI2yFlM3cOy01MUnLD5QeBSN0Fs4FdpS4It/APNsRG9dXJJuH8:Nap

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7368)

    • XORed URL has been found (YARA)

      • RedLine.MainPanel-cracked.exe (PID: 7668)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • RedLine.MainPanel-cracked.exe (PID: 7668)
      • WinRAR.exe (PID: 7368)

    • There is functionality for taking screenshot (YARA)

      • RedLine.MainPanel-cracked.exe (PID: 7668)

  • INFO

    • Checks supported languages

      • RedLine.MainPanel-cracked.exe (PID: 7668)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7368)

    • Reads the computer name

      • RedLine.MainPanel-cracked.exe (PID: 7668)

    • Reads the machine GUID from the registry

      • RedLine.MainPanel-cracked.exe (PID: 7668)

    • .NET Reactor protector has been detected

      • RedLine.MainPanel-cracked.exe (PID: 7668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(7668) RedLine.MainPanel-cracked.exe
Decrypted-URLs (1)http://ip-api.com/line/?fields=hostingM~
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 24609
UncompressedSize: 34304
OperatingSystem: Win32
ArchivedFileName: RedLine Stealer Cracked/Libraries/builder.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #XOR-URL redline.mainpanel-cracked.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7368"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RedLine Stealer Cracked.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7668"C:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\RedLine.MainPanel-cracked.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\RedLine.MainPanel-cracked.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RedLinePanel
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7368.2180\redline stealer cracked\redline.mainpanel-cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
xor-url
(PID) Process(7668) RedLine.MainPanel-cracked.exe
Decrypted-URLs (1)http://ip-api.com/line/?fields=hostingM~
8092C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 887
Read events
3 879
Write events
8
Delete events
0

Modification events

(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RedLine Stealer Cracked.rar
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7368) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
14
Suspicious files
7
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.Mdb.pdbbinary
MD5:0BA762B6B5FBDA000E51D66722A3BB2C
SHA256:D18EB89421D50F079291B78783408CEE4BAB6810E4C5A4B191849265BDD5BA7C
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.Pdb.dllexecutable
MD5:6CD3ED3DB95D4671B866411DB4950853
SHA256:D67EBD49241041E6B6191703A90D89E68D4465ADCE02C595218B867DF34581A3
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\builder.exeexecutable
MD5:2D6AC27235E545727F1C543CBCB4C606
SHA256:615AA9B90FB40C052EEA89F0B273ED0BC5A4AB218783D30F00ECD72D56B08A25
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.Pdb.pdbbinary
MD5:8E07476DB3813903E596B669D3744855
SHA256:AA6469974D04CBA872F86E6598771663BB8721D43A4A0A2A44CF3E2CD2F1E646
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.Mdb.dllexecutable
MD5:DC80F588F513D998A5DF1CA415EDB700
SHA256:90CFC73BEFD43FC3FD876E23DCC3F5CE6E9D21D396BBB346513302E2215DB8C9
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Bunifu_UI_v1.52.dllexecutable
MD5:5ECA94D909F1BA4C5F3E35AC65A49076
SHA256:DE0E530D46C803D85B8AEB6D18816F1B09CB3DAFEFB5E19FDFA15C9F41E0F474
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\builder.pdbbinary
MD5:418DC008EF956465E179EC29D3C3C245
SHA256:8C7E21B37540211D56C5FDBB7E731655A96945AA83F2988E33D5ADB8AA7C8DF1
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Newtonsoft.Json.dllexecutable
MD5:6815034209687816D8CF401877EC8133
SHA256:7F912B28A07C226E0BE3ACFB2F57F050538ABA0100FA1F0BF2C39F1A1F1DA814
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.pdbbinary
MD5:C0A69F1B0C50D4F133CD0B278AC2A531
SHA256:A4F79C99D8923BD6C30EFAFA39363C18BABE95F6609BBAD242BCA44342CCC7BB
7368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7368.2180\RedLine Stealer Cracked\Libraries\Mono.Cecil.Rocks.pdbbinary
MD5:17E3CCB3A96BE6D93CA3C286CA3B93DC
SHA256:CA54D2395697EFC3163016BBC2BB1E91B13D454B9A5A3EE9A4304012F012E5EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7920
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7920
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4024
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.128
  • 20.190.159.73
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.130
  • 40.126.31.1
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RedLine Stealer Cracked.rar