Extracted

• • Target
    SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.23083
  • Size 188KB
  • SHA256 d42440ec031ef76319b37c05d6e4307410e4796dc7736ca9b04184af56faba21
  • MD5 9a9433ea54265c64d630cfcdf7368371
  • SHA1 7a77794137c6cafee166453ccf6add4a5be3be42
  • SHA512 7011d088515c44f3fbb826209e509b7f023e8b50e5cc1b95835375e6e490a090388d537298634cf127628ef60e376d4a375b7714a6d0ef75b578d6d2a3c4639d
  • SSDEEP 3072:APiobdm9pzUv2nlTiML9Ocjfrj4Jk2f0v1yc4yaV20SJVuWfD:Ans9pIT7mfrj4Jk2iX+MvJVuWL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlineinfostealerredlinevip (tg: @fatherofcarders) 150kdiscoveryspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2