Extracted

• • Target

    b27a5ca0a0933895ea686376353fbe6981b8b1af825e3b887f4ca4544d6d6c91

  • Size

    346KB

  • MD5

    f81083e9f58ce4916e696520ea4f6254

  • SHA1

    a1d687bb752af5421309e86d56983a237b0768a5

  • SHA256

    b27a5ca0a0933895ea686376353fbe6981b8b1af825e3b887f4ca4544d6d6c91

  • SHA512

    2824c759ec73d4f49a579014ecd1fac14957a1806c54118045f4fcd81757ff10fa1fd02068313ec1c657c091a45800faecf6b8738e76ca46bd63b6a26feb5cc7

  Score

  10^/10

  redlinediscoveryinfostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1