Extracted

• • Target
    9fcebc54e8d0276b9723e45d8ae9eac3.exe
  • Size 570KB
  • SHA256 ffbb9cbfc1d209d6a3f4c835ecb844b8ab585a4834511613d34191165a3feb61
  • MD5 9fcebc54e8d0276b9723e45d8ae9eac3
  • SHA1 97075f6d91c325719360707113952b45f98839b7
  • SHA512 6b603b5b84fe9fa6fd517d3654aa1878482de4539ed4fc923ebb3dfaf21c0577f72f5e7a2d9353946afdcef6aaf54fd6fc65ef62b271176bee9e1cb34421b8cf
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinemix16.12discoveryinfostealerspywarestealersuricata

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2