Extracted

• • Target
    057d9e1958bd45653c231f985e418406.exe
  • Size 660KB
  • SHA256 534bc099de916a0dfac65cc74e45482dd160f053d7100156f35cabeb53de123d
  • MD5 057d9e1958bd45653c231f985e418406
  • SHA1 6d8b3d9e2ed65c2308212b0e27f6df7d0d069d52
  • SHA512 57a22154e77adc41580be51f122d34b5d54654d4210950422290a3bc3d98c286c4c0f5a8eb7ab67338e9bb6d1f510010e31bb3c05eed2c579f5a87a42a9c8fc5
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinemix 07.06discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2