Extracted

• • Target
    0af8097b0077ee4b5eb985c2cb03836b.exe
  • Size 651KB
  • SHA256 8ed4276b7bd2b1c80107c6817a5d18fdd9a88e6c69a5f8fbc0613fd682cbe744
  • MD5 0af8097b0077ee4b5eb985c2cb03836b
  • SHA1 e00c470090de2d7019254f6991f1c895406a0122
  • SHA512 84ea40b93a8d017f4d3bc350c3fc5e4d2b9b290e28324ee440fa9795e88fdb568d0b1f67a0d0b5f298bf7128f0da08a7e9e630afc7d43aa155f506414cc23e2e
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinemix23.09discoveryinfostealerspywarestealersuricata

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2