Extracted

• • Target

    68427aef7373e30b9099ab53dfbbe3e2e6972b617a0d253f301ffdcd8a73e759

  • Size

    3.4MB

  • MD5

    99e8524684e7dd23aee250e89373ad61

  • SHA1

    7ee72012f80ed456c2205cb7a19386936f77f776

  • SHA256

    68427aef7373e30b9099ab53dfbbe3e2e6972b617a0d253f301ffdcd8a73e759

  • SHA512

    c21738a00f79c505abf254ff3aa639b432b203decedbf5c4596f6e6282cbe3c90d0d2cd33295bced4e999c471b0f2b42ef7484af0fc026df7be434abfc003c8f

  • SSDEEP

    49152:4hnmfoP0PBHeRwUTCbrnyZQI4Wx99s/ijLo:4hnmfoP0PBHeRwUCbryZQI4Wx99s/i

  Score

  10^/10

  redlinesep16as1discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1