Extracted

• • Target

    78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466

  • Size

    360KB

  • MD5

    229f45ca9b43dc158b48ef4fe7c5b22a

  • SHA1

    1b54f317c29b894ecc74ad6a5c93a81fa4cbd298

  • SHA256

    78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466

  • SHA512

    e626f1532a08e038ade371b710ab98f5e528b668c8641a6d1836c7cfadfb0cff8ad6ae83f0367e76768d98ec00fe432ccb81d35f2da37bd5661e3f9c4cb65520

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

  Score

  10^/10

  redline0002discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1