Extracted

• • Target

    be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b

  • Size

    521KB

  • MD5

    c0318aa61a314fed79c87be28f0db3ba

  • SHA1

    361e5206d2e0aeb88174c524e6c7cfb90c94670d

  • SHA256

    be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b

  • SHA512

    619ad72faaa694d7dd141288c8f99738d3110fb2e08ea9a5feda3777d4d32456feca66a2e0da96a0610f475e358cb9bb99fc54a179fb98674f91cb205ff7a586

  • SSDEEP

    12288:bjNYGB77lC5eQoyLKWRIvwr222Zy+CQI1Cr2H:bjN99J2eOWF22ZaTe

  Score

  10^/10

  redlinebirjro1discoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Modifies WinLogon

    persistence
  behavioral1behavioral2