Extracted

Extracted

• • Target
    80394090013b95b4816adc33e2d44450
  • Size 867KB
  • SHA256 d19fdf53603310203c8bc83e1d27e14b60cac0a65932fe3824dedca50ff5c0a9
  • MD5 80394090013b95b4816adc33e2d44450
  • SHA1 2ed9641533d9eb0ac507c394c971407718a3afb6
  • SHA512 069a38ef06690655c2fbb254ed0b1e86fdff56bfdba7c2a27c852ba7666dc178cd626a4e833af8072f99002cb1e10a9c2473c76563f79677486b3951d0eb5300
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinediscoveryinfostealerspywarestealerlastlovely

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2