Extracted

Extracted

Extracted

• • Target

    26aae8d9f906f877165d9b85c93579b076edfecbac5dbf5620c84f9b43fb9524

  • Size

    2.6MB

  • MD5

    fc30d316182474ce09d3782e5fcf533f

  • SHA1

    59568bae39d4dc6021928e9496a1b12e3991b7a5

  • SHA256

    26aae8d9f906f877165d9b85c93579b076edfecbac5dbf5620c84f9b43fb9524

  • SHA512

    748916d63ceedc22c5f623257f4ffb106bd252e4dd73442e54331da1a17b979c0b9f8ceb0c871edf7a04e776e2feeb0209015e879a75b67c331f9df0a2803c6b

  • SSDEEP

    49152:pAI+ONpJc7YrEa2u2hq3PGh0lbPZF+tfFVBGY+8zYjZxXLuCBrENNyoUIOpRgP8C:pAI+4c8rHJ283PGoL/ITBwpzLuS2NJUI

  Score

  10^/10

  redline55076357887nam3discoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1