Extracted

• • Target

    file.exe

  • Size

    7.2MB

  • MD5

    a85ed5f62bfd0c7153b1ff809582dfce

  • SHA1

    56c6a8a811bb27fc19ffdadc6f474e6ae91ef919

  • SHA256

    ed32f2ebfc103f4c81e6e0bf07c269eba45692bb061b9cb28402a74f57871831

  • SHA512

    015339d3f0e9a178dc51a8de4ab82e43dc2a5b151619aebef8a023bc728d066ad168a474bc6ee02e0a93bb8f2cc9d6d902307ae57ee8da4b46d39d858b6367a3

  • SSDEEP

    196608:/H6dQmRrdA6lakaqdVTiWX97PMRtfp0yDA:ydQOlawdR7PMRtfpbA

  Score

  10^/10

  redline3.0.0.1discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2