Extracted

• • Target

    56ad4d7aac399dd64beaced638a6000f.exe

  • Size

    470KB

  • MD5

    56ad4d7aac399dd64beaced638a6000f

  • SHA1

    40724b8432d5a5ee18ca52645a56a80349ae5ace

  • SHA256

    a96519061c8c1af420d77cff87fcb88f409db5328dac7df3a91c235bc4ee5eec

  • SHA512

    cc6038ffd3b1eff55f18e9f37f8a277c0ab9a589b9f93c2e82c30db4773ccc7d0ce5e213adee018e6146079ced5034fbe518463c94d9b3462d84315dd3a7012b

  • SSDEEP

    6144:Hhb/Jr6KmZ4hihQonw60Ub0qS0YHUkX+v0w15QHvNyu8/Z4oOffzlKOMP5FajXs:Nhr6Ktihfw663X+M6gyBzOf7+5Ej

  Score

  10^/10

  redline12.10 mixdiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2