Extracted

• • Target
    92d8a8134cf80c396aeae2da2dcbe705.exe
  • Size 587KB
  • SHA256 a0c0c84c50b9cbb46063016dbfb74a83fb26a604a0bd5def3141b7bddd005818
  • MD5 92d8a8134cf80c396aeae2da2dcbe705
  • SHA1 f5e7553e7d11fa8588aa1f744f5f6e84754b34ad
  • SHA512 c7a4576442c24d3782d5a11fd2403d95e2448d61f98a4ada653eeeb40754eef021cc14248a1280e8c36a91e1da8667aa6bd6811f1646c34375eec93cba603b4b
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinemix 03.08discoveryinfostealerspywarestealersuricata

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2