Extracted

• • Target

    29dae5dccce65408a1782c9c18434252f33e1e3a240d702241db81f358f435cb

  • Size

    12.5MB

  • MD5

    cda71e8c760ae425afa297d42286e7cd

  • SHA1

    bbd5aef968962ac44007eb9b274ffb49b35f6478

  • SHA256

    29dae5dccce65408a1782c9c18434252f33e1e3a240d702241db81f358f435cb

  • SHA512

    71a2c38e06ea7ca9bb4ccce0b437f1ce117d28720ead361b6f52a75dff0eb85dbf97a3cfb1f1bbc3e9365905888bb5328ce33f74ccc6983149be5d6cf69ebe54

  • SSDEEP

    196608:QkXM2Ytcoq76D5/JlnclSQXwvmxqfeh0o6icDGwxXib9lY:zVqcoq7ClggG+y0Y8Xib

  Score

  10^/10

  redline@workaem1discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1