Extracted

• • Target
    d840e5bd0cf66a7913f064e53c3d657f.exe
  • Size 517KB
  • SHA256 0b1fa4775b6b671c54f187b9b55911ee1047ea1e5eff00d6272f50b4e4b2e169
  • MD5 d840e5bd0cf66a7913f064e53c3d657f
  • SHA1 068dce2ac9a4f6eb452d8e72e506e41a52e843db
  • SHA512 e0d881ce61f8c6bb8af761cf23dceb1e51b00fd545e61c4a856f4ba215ca3be5b4c0c58fd842d937ea16bc45e9b0c1f982c0fca76f3052bc2bd09e9de1de22d4
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinemix23.09discoveryinfostealerspywarestealersuricata

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2