Extracted

• • Target
    yes11.exe
  • Size 816KB
  • SHA256 284fa9b7685ebc3e71cf5d9956abe26103c8d9bafc29d3d417d4924dadfec00e
  • MD5 e2cbfed6f9d89e8ccdf2b68bf945972e
  • SHA1 a6530495857371ad151a50f549dacc0ee6f22da7
  • SHA512 bed1e4fa58848e2564d4e862be2f3241d09707729df38f5ea39c1ed9334b94217b50e21a4bfe27c6ff17a122157ebb130f86a621b2b7fa2c95acd25e41bba380
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline0815discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2