Extracted

• • Target
    a2b9c670d16437073eb791a641aa4bae.exe
  • Size 1.2MB
  • SHA256 17dfa2e1768aa1ef822527eec763f22090807a4aa4a674e8924090e7bc37bbef
  • MD5 a2b9c670d16437073eb791a641aa4bae
  • SHA1 43ceeb24af9507a106b5b246a511c80b2451a3ac
  • SHA512 48df98afc2c6b01c40580982baeac462c217728ce563f1ad9b32be907e0bdf48c3e2cb4101a45554fae48809e1dc49407fee6c07c0c9f015661d492bf62f5e65
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinebuild install botdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2