Extracted

• • Target
    ac1064081f8fdbfefd0157e16f9b2761.exe
  • Size 544KB
  • SHA256 ca0bc652d651f727d69fbb22cc91037bc825989e759fd54f6eb0cc118286506f
  • MD5 ac1064081f8fdbfefd0157e16f9b2761
  • SHA1 17e22c40cea27e5af57f045dff7f9798167f67b0
  • SHA512 dda9fe2547117278a9055381f9ddfa0d9398f8a58e4f53bdf8b9c86b7569eaa38cb1964bb9c7e5ce241df7f5b7854d7a9dee86cffd11f79daa6ba8bbe014420e
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinemix21.08discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2