Extracted

• • Target
    810307da04037b7e59ed98ffa629b5da.exe
  • Size 618KB
  • SHA256 e95cd5fcc8ae6b6c8c852ec533f57af4ff72e978a1a5a7fd0ae825ac407e6535
  • MD5 810307da04037b7e59ed98ffa629b5da
  • SHA1 015f98ba9c38e02194c3c61bc916bec4ffa90f03
  • SHA512 821f2a1f7a09b777f09f756bedd2cc1a4a8137578e158a2c4892bacd907e5b039c6f7407f1e49242ccaa0a6d917b5ad754404336c03b1df4e10726e248c09878
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline04.07discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2