Extracted

• • Target

    d57321805b57d9a004d652b7d8b00d9045d6940800653374e2a47c7dad2e9196

  • Size

    269KB

  • MD5

    286f83b1b21e6c05f1a687e5f1ca1c31

  • SHA1

    46b106a13e2396c0ba8df3f1e53467fbedd6aefc

  • SHA256

    d57321805b57d9a004d652b7d8b00d9045d6940800653374e2a47c7dad2e9196

  • SHA512

    d00ac23609be4b553b24ffdb7f93bcd8048ac855dee16a27b7f670e020d7d32367dd6eb5ed01d43e712d4943c0e9569d90c02ff5d1268e918f67914b352ad3db

  • SSDEEP

    1536:erae78zjORCDGwfdCSog01313Cs5gZl43Ni:mahKyd2n3175C43M

  Score

  10^/10

  redlinebuk2discoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1