Extracted

• • Target
    df5c0e79a474d705d3bae534112585fb.exe
  • Size 2.6MB
  • SHA256 bc01202df6fc9a64936da157f1c020da3f5bd3ef9e33cec3f84309e2963c5202
  • MD5 df5c0e79a474d705d3bae534112585fb
  • SHA1 8864ba24a1a6b3ebab55bbb41a59f7df4510f6ce
  • SHA512 037d762e10df319ccc4efc03632260fae0c4602d8f2fa7c79fcba7ce2e9491c20f82729f62e59c2416e8f246b865a0ff8da190638409281000bfb78d2ac8897b
  • SSDEEP 24576:Uu7ex3hC3Y+YC9p7A6RMvQdZwPocYhW2z63KD2oHILpIfel3RuQ55313K:mx3h8KwWXKD2oHI+2l3U
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline5397150605_99infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2