Extracted

• • Target
    a23edc8ced38a13512f37240c8dee007c7961aec410f0.exe
  • Size 2.6MB
  • SHA256 a23edc8ced38a13512f37240c8dee007c7961aec410f0aaeb9f3f966a837eab8
  • MD5 ada3d85d8a093eb5978a1400ca08cb42
  • SHA1 b89f304c3a45725432aba3b7a1d1b4509e2b02b7
  • SHA512 03de9d5637749c62b194f19a0483a12916194d454444403b51ec00d1bbe42adfc2312abfd365455f2d31a48d89f31aede232d1eec7bb708fa67bf84cf2707b4a
  • SSDEEP 24576:Lvqy5c4JRuUnUCuY1Yq6n2uUiM0cdTLJlLayVpkIgjmaDTzJ0V0b+NcJLpiyITl1:LvLJRfnUzE3VpkIgj5TVY0b+NcJIl3l
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline1609infostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2