Extracted

• • Target
    ad54fbfa5cd265112f67ea1b4d2e95a7.exe
  • Size 739KB
  • SHA256 57430cbbfebdef7c54698b00102dbd2098aef53ba4bd5fa43660c2e306f53482
  • MD5 ad54fbfa5cd265112f67ea1b4d2e95a7
  • SHA1 b92e996cffa1ad3b6e6a0c439f1bf21c72ccce51
  • SHA512 d4a4fc1b25f2f51f5ce6d40dc7277ee51af5004630449595348406663892ed4f2849bd3417b3e484ff409263083833a8c2c00d6758549bd92a901956a48afaf6
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline@mrhaluyeppdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2