Extracted

• • Target
    cbd082d48e8cbfa9d5b27644a1379e0d.exe
  • Size 366KB
  • SHA256 238999398161690f28d4e97cf0c0f7673fc5e9ad64397fbdf4e7f4e888d87958
  • MD5 cbd082d48e8cbfa9d5b27644a1379e0d
  • SHA1 b6ef7c58833fbbbc17bdd9b2e2ed301a30bdb084
  • SHA512 a9c1537f52a8a7ebb1aff1a1bbc265752cb7880a0fc499119954df6530ba2a3a47c5405778cea5548c730ee7b882093f64af87e48d24f249ce6ca56d85470030
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlineproxypubdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2