Extracted

• • Target
    22a3ae3ca57de176b84b525bcdd4f73b212684958f9d5.exe
  • Size 26KB
  • SHA256 22a3ae3ca57de176b84b525bcdd4f73b212684958f9d525cfd7e44f95f5d2dd7
  • MD5 9757b4680a2fd71aba63470146a00e53
  • SHA1 947a32a5b697b9c7e95156f60d5942b4113c6e39
  • SHA512 c2614f2d9733e4cc2ab9d7f6bb960ba4537f9e3375b1c2fab8b3eb72580dcb7167ebf07499377972e3588d04df03b63a9b63bae868d5f668a6a4edd785aec953
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline@xweloff_lztdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2