Extracted

• • Target

    1b3a7243e460cae69c7379e4db18b05f.exe

  • Size

    96KB

  • MD5

    1b3a7243e460cae69c7379e4db18b05f

  • SHA1

    81ea18f4b4226c9d399f046061917491a05f8987

  • SHA256

    b3eb3e4a5b10031072846f195aaba7454547b00e4913cb418d9c4418552b7638

  • SHA512

    8d493b14242c832cfddc537e898c6ec57127f6cc965b45781fe5999e4dc93bca815f497be02c0cdee3039c3f7e897139cf71ce37730e0e787e58b530e0502083

  • SSDEEP

    1536:V907dc8LdlbG6jejoigI2yYLB3UicrMFW08UAiqumbfcxv0ujXyyed13teulgS6F:o+e7Y2ciRWjUA57C0ujyzdOT

  Score

  10^/10

  redline1215935142discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2