Extracted

• • Target
    be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b
  • Size 521KB
  • SHA256 be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b
  • MD5 c0318aa61a314fed79c87be28f0db3ba
  • SHA1 361e5206d2e0aeb88174c524e6c7cfb90c94670d
  • SHA512 619ad72faaa694d7dd141288c8f99738d3110fb2e08ea9a5feda3777d4d32456feca66a2e0da96a0610f475e358cb9bb99fc54a179fb98674f91cb205ff7a586
  • SSDEEP 12288:bjNYGB77lC5eQoyLKWRIvwr222Zy+CQI1Cr2H:bjN99J2eOWF22ZaTe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinebirjro1discoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Modifies WinLogon

    persistence
  behavioral1behavioral2