Extracted

Extracted

• • Target

    463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe

  • Size

    4.5MB

  • MD5

    22b96b68b4372ff2ce604723e9436963

  • SHA1

    066ff406521cc2f0aed70414ee8d4d7751d0fe2a

  • SHA256

    463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe

  • SHA512

    0ecde5a89dd548cf16867c9a6c66c5b12f2b2e51920c1ab7cc1ff241f69a03116fe011aed2172c00cfe708c77856d5fe19d59b01a3880e3dfe38509a682d8a38

  Score

  10^/10

  allcomeredline@zexaninfostealerpersistencespywarestealer

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1