Extracted

• • Target

    da4f7ab4335741da73cdc9d9e8ec197aeb015aad2e149c8e903e9854fc8b2381

  • Size

    5.5MB

  • MD5

    24592dbf8073fce528cd270cd8fba5e1

  • SHA1

    f50fb2cd1772cc4bb336e8f1aeade9e12a65a817

  • SHA256

    da4f7ab4335741da73cdc9d9e8ec197aeb015aad2e149c8e903e9854fc8b2381

  • SHA512

    21e4147ce76080488f532683f273978112cb1aa1262e7c5bfb9c16c7bf84f8289b9c5d8894f5bb8cf90e9262873f21563d636492bb90a020537c27335ad481a5

  • SSDEEP

    49152:0PFJCvLqOaSTK5ISawpVpVliC8Tkx4HS2TQ:0PFsjqOaSFUN2T

  Score

  10^/10

  redlineanubis13discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2