Extracted

• • Target
    2b22da43ac64d6b8410941622f910268ced4cd4856393.exe
  • Size 362KB
  • SHA256 2b22da43ac64d6b8410941622f910268ced4cd4856393bda2c30c6dc1a99a8a1
  • MD5 417d7e10f1998c4b6e563320f820571c
  • SHA1 8e1b4964e1f3007d532849a2dcc24f3e2d58097f
  • SHA512 11c5e6f03c5b1041fb54427c598f12842103768318ac5cb0455b0c72df5067d2b3c3ac9d9a828a2321232854db6dacbb73007707932cec50d4b0c767ba5a1bb7
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlineproliv_02.06.2021discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2