Extracted

• • Target

    Setup.exe

  • Size

    4.9MB

  • MD5

    ac8ba09adf3b68f30c66161754abc4b8

  • SHA1

    79e4b354e1fb3851fc82328e78ddc600f8b002e6

  • SHA256

    c4a4e9711a986b18ce9bd24527a8701bfcb30efeacd70206662c768555a2d8f9

  • SHA512

    a57df74480c12fac25358e6d2fcca09d05ce803b422e4b5e71252da9f01d9ce8aaee4aad9be5a5671dec75e4824e56dba4c23a53cb090b3f4a2970dc4211d08f

  • SSDEEP

    98304:cmSvTP91uOuMvD+qhfvZQJilKExs6g2FkZ7Xg5HE:cdx1utMqqZvZk0xs6g2KZ7XkE

  Score

  10^/10

  redline@workaem1discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2