Extracted

• • Target
    db2432e8e08e1b6fd784c26b3a753115.exe
  • Size 219KB
  • SHA256 b5b66ebc918b440dbe042fa1ac958ee4bc6a1bb2249a77d69d25d2c9ed4f6dc1
  • MD5 db2432e8e08e1b6fd784c26b3a753115
  • SHA1 10a4437551e846d5f7df9fe1ef7cc6c59d767421
  • SHA512 dd996188fd06717ac3c2ad08a2f94a6d826e669ae38b1c6240ae90d6460e35b611703cbbad820cf2135e3148a41ec8a6cf81baf216aad9dea918f9706232af42
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline@kabanakusokdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2