Extracted

• • Target

    file.exe

  • Size

    7.5MB

  • MD5

    c1b44db2990ba08e43d65fa81e154449

  • SHA1

    9216a86f23f7cf335e2e98c147aa5f312717eecd

  • SHA256

    6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42

  • SHA512

    c5f68344ee1c973270305215704aba551acf9efad0a7b19980068c3c1444e2ad5b244015894dffcee9278e094f2a66f538d7b3e0e19b7ec921058748752f1d4a

  • SSDEEP

    196608:+F+hlISnMzMMbIVE58i1J3/vjN6FS1xv5Rq9ZuzPt:c+l/wkVESi1xv/5Y9Z+

  Score

  10^/10

  redline3108_ruzkidiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2