Extracted

• • Target
    68775806.exe
  • Size 557KB
  • SHA256 5d913dfaea341540468e089d54d3a903f95c3e177db7a4f8a96c91ae8e2bde9a
  • MD5 9192f4a80adf0e3dbc50cfb2070d5021
  • SHA1 6d0352a8e20817c62c749f882e1345b911d8712a
  • SHA512 cb7894024d58b01d5438d927f5e0fb054f2a2445be5a7f171b8a86dad53ceb9c6ae6139da9d791559be31016fc4fdecd6bf9d80af80ab98ed1f332b8a86cbf38
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline@black_santa21infostealerspywarevmprotect

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2